├── .gitignore
├── LICENSE
├── Makefile
├── QUICKSTART.md
├── README.md
├── RELEASE.md
├── cluster
    ├── Vagrantfile
    ├── docker17
    │   ├── bootstrap_centos.sh
    │   ├── centos_docker_install.sh
    │   ├── centos_prep.sh
    │   └── master.sh
    ├── k8s1.4
    │   ├── bootstrap_centos.sh
    │   ├── bootstrap_ubuntu.sh
    │   ├── k8smaster.sh
    │   └── k8sworker.sh
    ├── k8s1.6
    │   ├── bootstrap_centos.sh
    │   ├── bootstrap_ubuntu.sh
    │   ├── k8smaster.sh
    │   └── k8sworker.sh
    └── k8s1.8
    │   ├── bootstrap_centos.sh
    │   ├── bootstrap_ubuntu.sh
    │   ├── k8smaster.sh
    │   └── k8sworker.sh
├── install
    ├── ansible
    │   ├── Dockerfile
    │   ├── aci_cfg.yml
    │   ├── cfg.yml
    │   ├── env.json
    │   ├── install.sh
    │   ├── install_defaults.sh
    │   ├── install_swarm.sh
    │   ├── uninstall.sh
    │   └── uninstall_swarm.sh
    ├── genInventoryFile.py
    └── k8s
    │   ├── configs
    │       ├── aci_gw.yaml
    │       ├── cleanup.yaml
    │       ├── contiv-grafana.yml
    │       ├── contiv-prometheus.yml
    │       ├── contiv.yaml
    │       ├── etcd.yaml
    │       └── prometheus.yml
    │   ├── install.sh
    │   └── uninstall.sh
├── installer.png
└── scripts
    ├── build.sh
    ├── build_image.sh
    ├── download_ansible_repo.sh
    ├── generate-certificate.sh
    ├── get_latest_release.py
    ├── get_latest_release.sh
    ├── jenkins_cleanup.sh
    ├── kube_legacy_test.sh
    ├── kubeadm_test.sh
    ├── legacy_swarm_test.sh
    ├── prepare_netplugin_artifacts.sh
    ├── prepare_netplugin_images.sh
    ├── release.sh
    ├── swarm_mode_test.sh
    ├── unpack-installer.sh
    ├── vagrantup.sh
    └── vbcleanup.sh


/.gitignore:
--------------------------------------------------------------------------------
 1 | # vagrant data directories
 2 | .cfg*
 3 | .etc_*
 4 | cluster/.vagrant
 5 | cluster/export
 6 | cluster/*.log
 7 | release
 8 | artifact_staging/
 9 | 
10 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | Copyright 2017 Cisco Systems Inc. All rights reserved.
 2 | 
 3 | Licensed under the Apache License, Version 2.0 (the "License");
 4 | you may not use this file except in compliance with the License.
 5 | You may obtain a copy of the License at
 6 | http://www.apache.org/licenses/LICENSE-2.0
 7 | 
 8 | Unless required by applicable law or agreed to in writing, software
 9 | distributed under the License is distributed on an "AS IS" BASIS,
10 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11 | See the License for the specific language governing permissions and
12 | limitations under the License.
13 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
  1 | # backwards compatibility name for CONTIV_INSTALLER_VERSION
  2 | export BUILD_VERSION ?= devbuild
  3 | # sets the version for the installer output artifacts
  4 | export CONTIV_INSTALLER_VERSION ?= $(BUILD_VERSION)
  5 | # downloaded and built assets intended to go in installer by build.sh
  6 | export CONTIV_ARTIFACT_STAGING := $(PWD)/artifact_staging
  7 | # some assets are retrieved from GitHub, this is the default version to fetch
  8 | export DEFAULT_DOWNLOAD_CONTIV_VERSION := 1.2.0
  9 | export CONTIV_ACI_GW_VERSION ?= latest
 10 | export NETPLUGIN_OWNER ?= contiv
 11 | # setting NETPLUGIN_BRANCH compiles that commit on demand,
 12 | # setting CONTIV_NETPLUGIN_VERSION will download that released version
 13 | ifeq ($(NETPLUGIN_BRANCH),)
 14 | export CONTIV_NETPLUGIN_VERSION ?= $(DEFAULT_DOWNLOAD_CONTIV_VERSION)
 15 | export CONTIV_V2PLUGIN_VERSION ?= $(DEFAULT_DOWNLOAD_CONTIV_VERSION)
 16 | else
 17 | export CONTIV_NETPLUGIN_VERSION := $(NETPLUGIN_OWNER)-$(NETPLUGIN_BRANCH)
 18 | export CONTIV_V2PLUGIN_VERSION ?= $(NETPLUGIN_OWNER)-$(NETPLUGIN_BRANCH)
 19 | endif
 20 | export CONTIV_NETPLUGIN_TARBALL_NAME := netplugin-$(CONTIV_NETPLUGIN_VERSION).tar.bz2
 21 | export CONTIV_ANSIBLE_COMMIT ?= 8e20f56d541af8bc7a3ecbde0d9c64fa943812ed
 22 | export CONTIV_ANSIBLE_OWNER ?= contiv
 23 | # TODO(chrisplo): restore the normal default after 1.1.8 has been pushed
 24 | #export CONTIV_ANSIBLE_IMAGE ?= contiv/install:$(DEFAULT_DOWNLOAD_CONTIV_VERSION)
 25 | export CONTIV_ANSIBLE_IMAGE ?= contiv/install:1.1.7-bash-netcat
 26 | export CONTIV_V2PLUGIN_TARBALL_NAME := v2plugin-$(CONTIV_V2PLUGIN_VERSION).tar.gz
 27 | export CONTIV_ANSIBLE_COMMIT ?= 00da7b2a1fd9f631bcfe283a0a640d903ca389f4
 28 | export CONTIV_ANSIBLE_OWNER ?= contiv
 29 | 
 30 | # this is the classic first makefile target, and it's also the default target
 31 | # run when `make` is invoked with no specific target.
 32 | all: build
 33 | rel_ver = $(shell ./scripts/get_latest_release.sh)
 34 | 
 35 | # accepts CONTIV_ANSIBLE_COMMIT and CONTIV_ANSIBLE_OWNER environment vars
 36 | download-ansible-repo:
 37 | 	@scripts/download_ansible_repo.sh
 38 | 
 39 | # set NETPLUGIN_OWNER (default contiv) and NETPLUGIN_BRANCH make variables
 40 | # to compile locally
 41 | # e.g. make NETPLUGIN_OWNER=contiv NETPLUGIN_BRANCH=master
 42 | prepare-netplugin-artifacts:
 43 | 	@./scripts/prepare_netplugin_artifacts.sh
 44 | 
 45 | assemble-build:
 46 | 	@./scripts/build.sh
 47 | 
 48 | # build creates a release package for contiv.
 49 | # It uses a pre-built image specified by BUILD_VERSION.
 50 | build: download-ansible-repo prepare-netplugin-artifacts assemble-build
 51 | 
 52 | # ansible-image creates the docker image for ansible container
 53 | # It uses the version specified by BUILD_VERSION or creates an image with the latest tag.
 54 | ansible-image:
 55 | 	@bash ./scripts/build_image.sh
 56 | 
 57 | # Brings up a demo cluster to install Contiv on with docker, centos.
 58 | cluster-legacy-swarm: vagrant-clean
 59 | 	@bash ./scripts/vagrantup.sh legacy-swarm
 60 | 
 61 | # Brings up a demo cluster to install Contiv on with swarm, centos.
 62 | cluster-swarm-mode: vagrant-clean
 63 | 	@bash ./scripts/vagrantup.sh swarm-mode
 64 | 
 65 | # Brings up a demo cluster to install Contiv on with kubeadm, centos.
 66 | cluster-kubeadm: vagrant-clean
 67 | 	@bash ./scripts/vagrantup.sh kubeadm
 68 | 
 69 | cluster-destroy: vagrant-clean
 70 | 
 71 | # demo-swarm-mode brings up a cluster with native docker swarm, runs the installer on it, and shows the URL
 72 | # of the demo Contiv Admin Console which was set up
 73 | # BUILD_VERSION must be setup to use a specific build, e.g.
 74 | # export BUILD_VERSION=1.0.0-beta.3
 75 | # Or run make as BUILD_VERSION=1.0.0-beta.3 make demo-swarm-mode
 76 | demo-swarm-mode:
 77 | 	BUILD_VERSION=$(rel_ver) make cluster-swarm-mode
 78 | 	BUILD_VERSION=$(rel_ver) make install-test-swarm-mode
 79 | 
 80 | # demo-kubeadm brings up a cluster with kubeadm, runs the installer on it, and shows the URL
 81 | # of the demo Contiv Admin Console which was set up
 82 | # BUILD_VERSION must be setup to use a specific build, e.g.
 83 | # export BUILD_VERSION=1.0.0-beta.3
 84 | # Or run make as BUILD_VERSION=1.0.0-beta.3 make demo-kubeadm
 85 | demo-kubeadm:
 86 | 	BUILD_VERSION=$(rel_ver) make cluster-kubeadm
 87 | 	BUILD_VERSION=$(rel_ver) make install-test-kubeadm
 88 | 
 89 | # demo-swarm brings up a cluster with docker swarm, runs the installer on it, and shows the URL
 90 | # of the demo Contiv Admin Console which was set up
 91 | # BUILD_VERSION must be setup to use a specific build, e.g.
 92 | # export BUILD_VERSION=1.0.0-beta.3
 93 | # Or run make as BUILD_VERSION=1.0.0-beta.3 make demo-legacy-swarm
 94 | demo-legacy-swarm:
 95 | 	BUILD_VERSION=$(rel_ver) make cluster-legacy-swarm
 96 | 	BUILD_VERSION=$(rel_ver) make install-test-legacy-swarm
 97 | 
 98 | vagrant-clean:
 99 | 	cd cluster && vagrant destroy -f
100 | 	@bash ./scripts/vbcleanup.sh
101 | 
102 | # Create a build and test the release installation on a vagrant cluster
103 | # TODO: The vagrant part of this can be optimized by taking snapshots instead
104 | # of creating a new set of VMs for each case
105 | release-test-swarm-mode: build
106 | 	# Test swarm-mode (centos by default)
107 | 	make cluster-swarm-mode
108 | 	make install-test-swarm-mode
109 | 
110 | # create k8s release testing image (do not contains ansible)
111 | k8s-build: prepare-netplugin-images assemble-build
112 | 
113 | prepare-netplugin-images:
114 | 	@bash ./scripts/prepare_netplugin_images.sh
115 | # Create a build and test the release installation on a vagrant cluster
116 | # TODO: The vagrant part of this can be optimized by taking snapshots instead
117 | # of creating a new set of VMs for each case
118 | release-test-kubeadm: k8s-build
119 | 	# Test kubeadm (centos by default)
120 | 	make cluster-kubeadm
121 | 	make install-test-kubeadm
122 | 
123 | release-test-legacy-swarm: build
124 | 	# Test docker + swarm (centos by default)
125 | 	make cluster-legacy-swarm
126 | 	make install-test-legacy-swarm
127 | 
128 | release-test-kubelegacy: build
129 | 	# Test k8s ansible (centos by default)
130 | 	make cluster-kubeadm
131 | 	make install-test-kube-legacy
132 | 
133 | # shfmt reformats all shell scripts in this repo
134 | shfmt:
135 | 	go get github.com/contiv-experimental/sh/cmd/shfmt
136 | 	find . -type f -name "*.sh" -print0 | xargs -0 shfmt -w
137 | 
138 | # Test the installation on the provided cluster. This is for bare-metal and other
139 | # setups where the cluster is created using non-vagrant mechanisms.
140 | # Clusters need to have k8s installed for kubernetes kubeadm based mechanism and
141 | # docker installed on the master node for all others.
142 | install-test-swarm-mode:
143 | 	@bash ./scripts/swarm_mode_test.sh
144 | 
145 | install-test-kubeadm:
146 | 	@bash ./scripts/kubeadm_test.sh
147 | 
148 | install-test-kube-legacy:
149 | 	@bash ./scripts/kube_legacy_test.sh
150 | 
151 | install-test-legacy-swarm:
152 | 	@bash ./scripts/legacy_swarm_test.sh
153 | 
154 | # ci does everything necessary for a Github PR-triggered CI run.
155 | # currently, this means building a container image and running
156 | # all of the available tests.
157 | ci: release-test-kubeadm
158 | ci-old: release-test-swarm-mode release-test-kubeadm release-test-legacy-swarm
159 | 
160 | .PHONY: all build cluster cluster-destroy release-test-legacy-swarm release-test-swarm-mode release-test-kubeadm release-test-kubelegacy install-test-legacy-swarm install-test-swarm-mode install-test-kubeadm install-test-kube-legacy k8s-build prepare-netplugin-images
161 | 


--------------------------------------------------------------------------------
/QUICKSTART.md:
--------------------------------------------------------------------------------
 1 | # Quick Start Guide
 2 | 
 3 | Please follow the tutorials [here](http://contiv.github.io/documents/tutorials/).
 4 | 
 5 | ## Quick Start Guide for CentOS 7.x hosts
 6 | 
 7 | * Setup the pre-requisites as follows and follow the demo instructions above
 8 | ```
 9 |  wget https://releases.hashicorp.com/vagrant/1.9.1/vagrant_1.9.1_x86_64.rpm
10 |  wget http://download.virtualbox.org/virtualbox/5.1.14/VirtualBox-5.1-5.1.14_112924_el7-1.x86_64.rpm
11 |  sudo yum install VirtualBox-5.1-5.1.14_112924_el7-1.x86_64.rpm -y
12 |  sudo yum install vagrant_1.9.1_x86_64.rpm -y
13 |  sudo yum install docker -y
14 |  sudo systemctl start docker
15 |  git clone http://github.com/contiv/install
16 | ```
17 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Contiv Installation for Docker Swarm & Kubernetes 1.4+
 2 | Install Contiv on your Docker Swarm or Kubernetes cluster.
 3 | 
 4 | ## Docker Swarm Installation
 5 | ### Prerequisites
 6 | * CentOS 7.x operating system.
 7 | * Python installed on the master and worker nodes.
 8 | * Docker installed on the host where you are running the installer.
 9 | * Install a Docker Swarm cluster in either legacy swarm mode or native swarm mode (requires 17.03+ version of Docker engine where swarm functionality is inbuilt). Alternatively, use the Contiv installer to setup docker and legacy swarm stack on cluster nodes.
10 | 
11 | ### Contiv Installation with Legacy Swarm Mode
12 | 
13 | The Contiv Docker Swarm installer is launched from a host external to the cluster.  All the nodes must be accessible to the Contiv Ansible-based installer host through SSH.
14 | ![installer](installer.png)
15 | * Download the installer bundle: <br>`curl -L -O https://github.com/contiv/install/releases/download/$VERSION/contiv-$VERSION.tgz`<br>
16 | If your access to the Internet is limited or slow and you want to download the full Contiv install, choose <br>
17 | `contiv-full-$VERSION.tgz`<br>
18 | Note: The full image contains only Contiv components. Installing Docker Swarm will need Internet connectivity.
19 | * Extract the install bundle <br>`tar oxf contiv-$VERSION.tgz`.
20 | * Change directories to the extracted folder <br>`cd contiv-$VERSION`
21 | 
22 | * To install Contiv with Docker Legacy Swarm:<br> `./install/ansible/install_swarm.sh -f cfg.yml -e <ssh key> -u <username> -i`
23 | * To install Contiv with Docker Legacy Swarm and ACI:<br> `./install/ansible/install_swarm.sh -f aci_cfg.yml -e <ssh key> -u <username> -i -m aci`
24 | 
25 | * Example host config files are available at install/ansible/cfg.yml and install/ansible/aci_cfg.yml
26 | * To see additional install options and examples, run <br>`./install/ansible/install_swarm.sh -h`.
27 | 
28 | ### Contiv Installation with Native Swarm Mode
29 | 
30 | Docker swarm cluster must be already setup (see [details](https://docs.docker.com/engine/swarm/)). Installer only sets up Contiv v2plugin and dependencies. The Contiv installer can be run from a host in cluster itself.
31 | 
32 | * Download the installer bundle: <br>`curl -L -O https://github.com/contiv/install/releases/download/$VERSION/contiv-$VERSION.tgz`<br>
33 | If your access to the Internet is limited or slow and you want to download the full Contiv install, choose <br>
34 | `contiv-full-$VERSION.tgz`<br>
35 | Note: The full image contains only Contiv components.
36 | * Extract the install bundle <br>`tar oxf contiv-$VERSION.tgz`.
37 | * Change directories to the extracted folder <br>`cd contiv-$VERSION`
38 | 
39 | * To install Contiv v2plugin:<br> `./install/ansible/install_swarm.sh -f cfg.yml -e <ssh key> -u <username> -p`
40 | 
41 | * Example host config files are available at install/ansible/cfg.yml and install/ansible/aci_cfg.yml
42 | * To see additional install options and examples, such as adding arguments to ansible for verbose output and proxy settings, run <br>`./install/ansible/install_swarm.sh -h`.
43 | 
44 | ### Removing Contiv
45 | 
46 | If you need to remove Contiv from Docker Swarm and return to your original state, you can uninstall Contiv with the following commands:
47 | * To uninstall Contiv and Docker Legacy Swarm:<br>
48 | `./install/ansible/uninstall_swarm.sh -f cfg.yml -e <ssh key> -u <username> -i`
49 | * To uninstall Contiv and Docker Legacy Swarm with ACI support:<br>
50 | `./install/ansible/uninstall_swarm.sh -f aci_cfg.yml -e <ssh key> -u <username> -i -m aci`
51 | * To uninstall Contiv and not Docker Legacy Swarm:<br>
52 | `./install/ansible/uninstall_swarm.sh -f cfg.yml -e <ssh key> -u <username>`
53 | * To uninstall Contiv v2plugin:<br>
54 | `./install/ansible/uninstall_swarm.sh -f cfg.yml -e <ssh key> -u <username> -p`
55 | * Note: Adding the `-r` flag, will cleanup any Contiv state.
56 | * To see additional install options and examples, such as adding arguments to ansible for verbose output and proxy settings, run <br>`./install/ansible/uninstall_swarm.sh -h`.
57 | 
58 | ## Kubernetes Installation
59 | 
60 | ### Prerequisites
61 | 
62 | * Kubernetes 1.6.2+, and 1.8.4+ are supported with the following instructions.
63 | * CentOS 7.x operating system
64 | * Install Kubernetes:
65 |   1. kubeadm installs the latest Kubernetes version. <br>
66 |      For Kubernetes 1.6, see an example script [here.](https://github.com/contiv/install/blob/master/cluster/k8s1.6/k8smaster.sh)
67 |      For Kubernetes 1.8, see an example script [here.](https://github.com/contiv/install/blob/master/cluster/k8s1.8/k8smaster.sh)
68 |   1. Replace step (3/4) in the kubeadm install guide with the following Contiv Installation Instructions. Contiv installation can be done after completing step (4/4).
69 |   1. Instructions to install Kubernetes are available [here.](http://kubernetes.io/docs/getting-started-guides/kubeadm/)
70 | 
71 | ### Contiv Installation
72 | * Run the following commands on the kubernetes master host.
73 | * Use curl to get the installer bundle: <br>`curl -L -O https://github.com/contiv/install/releases/download/$VERSION/contiv-$VERSION.tgz`
74 | * Extract the install bundle <br>`tar oxf contiv-$VERSION.tgz`.
75 | * Change directories to the extracted folder <br>`cd contiv-$VERSION`
76 | * To install Contiv with VXLAN:<br> `sudo ./install/k8s/install.sh -n $CONTIV_MASTER`
77 | * **NOTE:** Use the same IP for CONTIV_MASTER as you use for --api-advertise-addresses in kubeadm init.
78 | * To install Contiv specifying a data plane interface for VLAN:<br> `sudo ./install/k8s/install.sh -n $CONTIV_MASTER -v <data plane interface like eth1>`
79 | * **NOTE:** Ensure that the data plane interface is the same on all the worker nodes.
80 | * To install Contiv with ACI: <br>`./install/k8s/install.sh -n $CONTIV_MASTER -a <APIC URL> -u <APIC User> -p <APIC Password> -l <Leaf Nodes> -d <Physical Domain> -e <EPG Bridge domain> -m <APIC contracts unrestricted mode>
81 |   ` <br> For example: <br> `./install/k8s/install.sh -n <netmaster DNS/IP> -a https://apic_host:443 -u apic_user -p apic_password -l topology/pod-xxx/node-xxx -d phys_domain -e not_specified -m no
82 |   `
83 |  <br> where `$CONTIV_MASTER` is the Contiv proxy or Net Master IP.
84 | * To install Contiv with a custom infra network and gateway: <br>`./install/k8s/install.sh -n <netmaster DNS/IP> -g <GATEWAY IP> -i <SUBNET>`
85 | * To see additional install options, run <br> `./install/ansible/install.sh`.
86 | 
87 | ### Removing Contiv
88 | * To uninstall Contiv, retaining the etcd state, run:<br>
89 | `sudo ./install/k8s/uninstall.sh`
90 | * To uninstall Contiv, cleaning up the etcd state, run:<br>
91 | `sudo ./install/k8s/uninstall.sh etcd-cleanup`. <br>Use this option to cleanup all the Contiv network state. 
92 | * To stop Contiv, go to the install folder contiv-$VERSION and run:<br> `kubectl delete -f .contiv.yaml`
93 | * To start Contiv, go to the install folder contiv-$VERSION and run:<br> `kubectl apply -f .contiv.yaml`
94 | * To remove etcd state when Contiv is stopped, run: <br> `rm -rf /var/etcd/contiv-data`
95 | 


--------------------------------------------------------------------------------
/RELEASE.md:
--------------------------------------------------------------------------------
 1 | # Automated releases
 2 | TBD
 3 | 
 4 | # Testing installer builds of any netplugin branch
 5 | Normally, the installer requires the contiv netplugin version to be a released version hosted on github, as it pulls that archive down either during install or caches it prior to install.
 6 | 
 7 | Instead, to create an installer for the legacy docker swarm of any branch of contiv, additionally set these two environment variables:
 8 | 
 9 | * NETPLUGIN_BRANCH - the branch to checkout, compile, and archive
10 | * NETPLUGIN_OWNER (if not contiv) - the username for the netplugin fork
11 | 
12 | This will only provide a "full" installer with the netplugin archive in `contiv_cache`
13 | 
14 | Other types of installs such as v2plugin do not yet support builds targeting specific branches, they only support building installers for released versions of netplugin.
15 | 
16 | #### Example:
17 | 
18 | ```
19 | NETPLUGIN_BRANCH=v2plugin_local_versioned NETPLUGIN_OWNER=chrisplo make build
20 | ```
21 | 
22 | Can produce netplugin binary archive at
23 | `contiv-devbuild/contiv_cache/netplugin-ca1b582.tar.bz2`
24 | and a symlink in the same directory to that archive named `netplugin-chrisplo-v2plugin_local_versioned.tar.bz2`
25 | 
26 | That archive will be used for netplugin binaries instead of a released archive hosted on github.
27 | 
28 | # Manual releases
29 | 1. Check out the right branch and the right commit. This is necessary
30 | when not releasing from the HEAD of master.
31 | 
32 | 2. Tag the right commit and push it to GitHub. This is mandatory if the
33 | release isn't made from the HEAD of master.
34 | 	```
35 | 	git tag 1.0.1 3aba546aea1235
36 | 	git push origin 1.0.1
37 | 	```
38 | 
39 | 3. Set BUILD_VERSION, e.g., 1.0.0-beta.3. Set or update the following variables under script/build.sh. Merge via PR to appropriate branch.
40 | 
41 | 	```
42 | 	auth_proxy_version=${CONTIV_API_PROXY_VERSION:-"1.0.0-beta.3"}
43 | 	aci_gw_version=${CONTIV_ACI_GW_VERSION:-"latest"}
44 | 	contiv_version=${CONTIV_VERSION:-"1.0.0-beta.3"}
45 | 	etcd_version=${CONTIV_ETCD_VERSION:-v2.3.8}
46 | 	docker_version=${CONTIV_DOCKER_VERSION:-1.12.6}
47 | 	```
48 | 
49 | 4. Build docker binary image. This would create a docker image contiv/install:$BUILD_VERSION. It also creates two release bundles - contiv-${BUILD_VETSION}.tgz and contiv-full-${BUILD_VERSION}.tgz. This version should be tested locally using a vagrant setup with release-test-* make targets.
50 | 
51 | 	```
52 | 	make ansible-image
53 | 	```
54 | 
55 | 5. Execute ```./scripts/release.sh``` Creates a new release on GitHub.
56 | 
57 | 	```
58 | 	export GITHUB_USER=contiv
59 |         export GITHUB_TOKEN=<your token here>
60 |         ./scripts/release.sh
61 |         ```
62 | 
63 | 6. Push image to docker hub
64 | 
65 | 	```
66 | 	docker login -u $docker_user -p $docker_password
67 | 	docker push contiv/install:$BUILD_VERSION
68 | 	```
69 | 


--------------------------------------------------------------------------------
/cluster/Vagrantfile:
--------------------------------------------------------------------------------
  1 | # -*- mode: ruby -*-
  2 | # vi: set ft=ruby :
  3 | require 'rubygems'
  4 | require 'fileutils'
  5 | require 'yaml'
  6 | 
  7 | DEFAULT_K8S_VERSION = 'v1.8.4'.freeze
  8 | 
  9 | # Guest OS versions for testing
 10 | UBUNTU = 'ubuntu'.freeze
 11 | CENTOS = 'centos'.freeze
 12 | RHEL = 'rhel7'.freeze
 13 | 
 14 | BOX_VERSION = ENV['BOX_VERSION'] || '1707.01'.freeze
 15 | HOST_SHARED_FOLDER = './export/'.freeze
 16 | GUEST_SHARED_FOLDER = '/shared'.freeze
 17 | # Different orchestration platforms we support
 18 | ORC_LEGACY_SWARM = 'legacy-swarm'.freeze
 19 | ORC_SWARM = 'swarm-mode'.freeze
 20 | ORC_KUBEADM = 'kubeadm'.freeze
 21 | ORC_KUBEADM_IDX = 2
 22 | 
 23 | num_nodes = (ENV["CONTIV_NODES"] || 2).to_i
 24 | num_masters = (ENV["CONTIV_MASTERS"] || 1).to_i
 25 | num_workers = num_nodes - num_masters
 26 | 
 27 | 
 28 | # Global vars
 29 | token = 'd900e1.8a392798f13b33a4'
 30 | node_os = ENV['CONTIV_NODE_OS'] || CENTOS
 31 | k8s_ver = ENV['CONTIV_K8S_VERSION'] || DEFAULT_K8S_VERSION
 32 | orc_path = case k8s_ver
 33 |            when /^v1\.[45]\./ then 'k8s1.4/'
 34 |            when /^v1\.[67]\./ then 'k8s1.6/'
 35 |            when /^v1\.[8]\./ then 'k8s1.8/'
 36 |            else
 37 |              raise "unsupported k8s version: #{k8s_ver}"
 38 |            end
 39 | 
 40 | swarm_path = 'docker17/'
 41 | orchestrators = [ORC_LEGACY_SWARM, ORC_SWARM, ORC_KUBEADM]
 42 | 
 43 | # method to create an etc_hosts file based on the cluster info
 44 | def create_etc_hosts(node_names, node_ips, o)
 45 |   hosts = "127.0.0.1   localhost\n"
 46 | 
 47 |   node_names.zip(node_ips).each do |node, ip|
 48 |     hosts << "#{ip}   #{node} \n"
 49 |   end
 50 | 
 51 |   etc_file = (ENV['VAGRANT_CWD'] || '.') + '/.etc_hosts_' + o
 52 |   File.write(etc_file, hosts)
 53 | end
 54 | 
 55 | # method to create an cfg file based on the cluster info
 56 | # This cfg file is used for ansible installations
 57 | def create_cfg_info(node_ips, o, masters)
 58 |   node_os = ENV['CONTIV_NODE_OS'] || CENTOS
 59 |   conn = {}
 60 |   node_ips.each_with_index do |node_ip, n|
 61 |     node = if n < masters
 62 |              { 'role' => 'master' }
 63 |            else
 64 |              {}
 65 |            end
 66 |     def_ctrl_if = node_os == UBUNTU ? 'enp0s8' : 'eth1'
 67 |     def_data_if = node_os == UBUNTU ? 'enp0s9' : 'eth2'
 68 |     node['control'] = ENV['CONTIV_CONTROL_IF'] || def_ctrl_if
 69 |     node['data'] = ENV['CONTIV_DATA_IF'] || def_data_if
 70 |     conn[node_ip] = node
 71 |   end
 72 |   cfg_data = { 'CONNECTION_INFO' => conn }
 73 |   cfg_file = (ENV['VAGRANT_CWD'] || '.') + '/.cfg_' + o + '.yaml'
 74 |   File.write(cfg_file, cfg_data.to_yaml)
 75 | end
 76 | 
 77 | provision_node = <<SCRIPT
 78 | echo "export https_proxy='$2'" >> /etc/profile.d/envvar.sh
 79 | echo "export http_proxy='$1'" >> ~/.profile
 80 | echo "export https_proxy='$2'" >> ~/.profile
 81 | source /etc/profile.d/envvar.sh
 82 | SCRIPT
 83 | 
 84 | provision_net_ubuntu = <<SCRIPT
 85 | sudo yum install -y net-tools
 86 | cat <<EOF > /etc/hosts
 87 | $1
 88 | EOF
 89 | ifup eth1
 90 | SCRIPT
 91 | 
 92 | provision_net_centos = <<SCRIPT
 93 | cat <<EOF > /etc/hosts
 94 | $1
 95 | EOF
 96 | SCRIPT
 97 | 
 98 | provision_key = <<SCRIPT
 99 | sudo apt-get install python -y
100 | mkdir -p /home/ubuntu/.ssh/
101 | cat <<EOF >> /home/ubuntu/.ssh/authorized_keys
102 | $1
103 | EOF
104 | SCRIPT
105 | 
106 | # Begin execution here
107 | base_ip = ENV['CONTIV_IP_PREFIX'] || '192.168.2.'
108 | ip = 50
109 | # This configuration creates the configuration for all the VMs
110 | # So we have num_nodes * orchestrators.size VMs that will be listed in
111 | # vagrant status etc. All the VMs are marked autostart: false, so
112 | # they have to be started explicitly using vagrant up <vm name>
113 | # node_names are like kubeadm-master, kubeadm-worker0 etc for each
114 | # orchestrator.
115 | node_names = []
116 | node_ips = []
117 | node_orcs = []
118 | master_ips = []
119 | 
120 | orchestrators.each do |o|
121 |   # Save the start location in IP array
122 |   start = node_ips.length
123 | 
124 |   num_masters.times do |n|
125 |     if n.zero?
126 |        node_names.push("#{o}-master")
127 |     else
128 |        node_names.push("#{o}-master#{n}")
129 |     end
130 |   end
131 |   num_workers.times do |n|
132 |     node_names.push("#{o}-worker#{n}")
133 |   end
134 |   master_ips.push("#{base_ip}#{ip}")
135 |   num_nodes.times do
136 |     node_ips.push("#{base_ip}#{ip}")
137 |     node_orcs.push(o)
138 |     ip += 1
139 |   end
140 | 
141 |   create_etc_hosts(node_names[start, num_nodes], node_ips[start, num_nodes], o)
142 |   create_cfg_info(node_ips[start, num_nodes], o, num_masters)
143 | end
144 | 
145 | # Check for plugin pre-reqs.
146 | # We need vagrant registration plugin to register redhat boxes.
147 | if node_os == RHEL
148 |   unless Vagrant.has_plugin?('vagrant-registration')
149 |     raise 'vagrant-registration plugin is not installed!'
150 |   end
151 | end
152 | 
153 | # ensure that ipv4 forwarding is enabled if we're on Linux
154 | forward_file = "/proc/sys/net/ipv4/ip_forward"
155 | 
156 | if File.exists?(forward_file) && File.read(forward_file).strip == "0"
157 |   puts "Please enable ipv4 forwarding by running the following command:"
158 |   puts "    sudo sysctl -w net.ipv4.ip_forward=1"
159 | 
160 |   exit 1
161 | end
162 | 
163 | # show a warning that the FORWARD chain policy must be set to ACCEPT on Debian/Ubuntu
164 | # systems since they default to REJECT.  we can't check the actual value because root
165 | # access is required.
166 | if ARGV[0] == "up" && File.exists?("/etc/debian_version")
167 |   puts
168 |   puts "NOTE: Please ensure that the FORWARD chain's policy is set to ACCEPT"
169 |   puts "      by running: sudo iptables -P FORWARD ACCEPT"
170 |   puts
171 | end
172 | 
173 | VAGRANTFILE_API_VERSION = '2'.freeze
174 | Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
175 |   config.vm.box_check_update = false
176 |   config.vbguest.auto_update = false if Vagrant.has_plugin?('vagrant-vbguest')
177 | 
178 |   if node_os == RHEL
179 |     config.registration.manager = 'subscription_manager'
180 |     config.registration.username = ENV['CONTIV_RHEL_USER']
181 |     config.registration.password = ENV['CONTIV_RHEL_PASSWD']
182 |   end
183 |   config.vm.provider 'virtualbox' do |v|
184 |     v.linked_clone = true if Vagrant::VERSION >= '1.8'
185 |   end
186 | 
187 |   (num_nodes * orchestrators.size).times do |n|
188 |     node_name = node_names[n]
189 |     node_addr = node_ips[n]
190 |     node_orc = node_orcs[n]
191 | 
192 |     config.vm.define node_name, autostart: false do |c|
193 |       if node_os == RHEL
194 |         # Download rhel7.2 box from https://access.redhat.com/downloads/content/293/ver=2/rhel---7/2.0.0/x86_64/product-software
195 |         # Add it as rhel7 vagrant box add rhel-cdk-kubernetes-7.2-29.x86_64.vagrant-virtualbox.box --name=rhel7
196 |         # run this command once you done with adding vagrant box : vagrant plugin install vagrant-registration
197 |         # You need to export following variable, in order to run on RHEL7
198 |         # export CONTIV_RHEL_USER=<your developer account username of redhat site>
199 |         # export CONTIV_RHEL_PASSWD=<your developer account password of redhat site>
200 |         # export CONTIV_NODE_OS=rhel7
201 |         c.vm.box = 'rhel7'
202 |         config.ssh.insert_key = false
203 |       elsif node_os == UBUNTU
204 |         c.vm.box = 'ubuntu/xenial64'
205 |       else
206 |         if node_orc == ORC_SWARM
207 |           c.vm.box = 'contiv/centos73'
208 |           c.vm.box_version = '0.10.1'
209 |         else
210 |           c.vm.box = 'centos/7'
211 |           c.vm.box_version = BOX_VERSION
212 |         end
213 |         config.ssh.insert_key = false
214 |       end
215 | 
216 |       c.vm.provision 'shell' do |s|
217 |         s.inline = provision_node
218 |         s.args = [ENV['http_proxy'] || '', ENV['https_proxy'] || '']
219 |       end
220 |       if node_orc == ORC_SWARM
221 |         config.vm.synced_folder HOST_SHARED_FOLDER, GUEST_SHARED_FOLDER, create: true
222 |       end
223 |       c.vm.provision 'shell' do |s|
224 |         s.inline = node_os == UBUNTU ? provision_net_centos : provision_net_ubuntu
225 |         etc_file = (ENV['VAGRANT_CWD'] || '.') + '/.etc_hosts_' + node_orc
226 |         hosts = File.read(etc_file)
227 |         s.args = [hosts]
228 |       end
229 | 
230 |       # configure ip address etc
231 |       c.vm.hostname = node_name
232 |       c.vm.network :private_network, ip: node_addr
233 |       c.vm.network :private_network, ip: node_addr, virtualbox__intnet: 'true', auto_config: false
234 | 
235 |       c.vm.provider 'virtualbox' do |v|
236 |         v.memory = node_orc == ORC_KUBEADM && master_ips.include?(node_addr) ? 2048 : 512
237 |         # make all nics 'virtio' to take benefit of builtin vlan tag
238 |         # support, which otherwise needs to be enabled in Intel drivers,
239 |         # which are used by default by virtualbox
240 |         v.customize ['modifyvm', :id, '--nictype1', 'virtio']
241 |         v.customize ['modifyvm', :id, '--nictype2', 'virtio']
242 |         v.customize ['modifyvm', :id, '--nictype3', 'virtio']
243 |         v.customize ['modifyvm', :id, '--nicpromisc2', 'allow-all']
244 |         v.customize ['modifyvm', :id, '--nicpromisc3', 'allow-all']
245 |         v.customize ['modifyvm', :id, '--paravirtprovider', 'kvm']
246 |       end # v
247 | 
248 |       if node_os == UBUNTU
249 |         c.vm.provision 'shell' do |s|
250 |           s.inline = provision_key
251 |           key = File.read(ENV['CONTIV_SSH_CERT'] || ENV['HOME'] + '/.ssh/id_rsa.pub')
252 |           s.args = [key]
253 |         end
254 |       end
255 |       if node_orc != ORC_KUBEADM && node_os != UBUNTU
256 |         c.vm.provision :shell, inline: 'yum install policycoreutils-python -y'
257 |       end
258 | 
259 |       if node_orc == ORC_KUBEADM
260 |         # kubeadm specific bootstrap tasks
261 |         if node_os == RHEL
262 |           c.vm.provision 'shell', inline: <<-EOS
263 |             yum remove -y kubernetes-node-*
264 |             yum remove -y kubernetes-client-*
265 |             EOS
266 |         elsif node_os == UBUNTU
267 |           c.vm.provision :shell, path: orc_path + 'bootstrap_ubuntu.sh'
268 |         else
269 |           c.vm.provision :shell, path: orc_path + 'bootstrap_centos.sh'
270 |         end
271 |         if master_ips.include? node_addr
272 |           # Install kubernetes on master
273 |           c.vm.provision :shell, path: orc_path + 'k8smaster.sh', args: [token, node_addr, k8s_ver, 'vagrant']
274 |         else
275 |           # Install kubernetes on nodes
276 |           c.vm.provision :shell, path: orc_path + 'k8sworker.sh', args: [token, master_ips[ORC_KUBEADM_IDX]]
277 |         end # if
278 |       elsif node_orc == ORC_SWARM
279 |         # swarm specific bootstrap tasks
280 |         if node_os == CENTOS
281 |           c.vm.provision :shell, path: swarm_path + 'bootstrap_centos.sh'
282 |           if master_ips.include? node_addr
283 |             # Start swarm on master
284 |             c.vm.provision :shell, path: swarm_path + 'master.sh', args: [node_addr, GUEST_SHARED_FOLDER]
285 |           else
286 |             # Run the generated swarm join command line from worker
287 |             c.vm.provision :shell, path: HOST_SHARED_FOLDER + 'worker.sh'
288 |           end
289 |         else
290 |           raise 'Swarm install is currently supported only on CentOS'
291 |         end
292 |       end
293 |     end # c
294 |   end # role
295 | end # config
296 | 


--------------------------------------------------------------------------------
/cluster/docker17/bootstrap_centos.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | yum install -y yum-utils
11 | yum-config-manager \
12 | 	--add-repo \
13 | 	https://download.docker.com/linux/centos/docker-ce.repo
14 | 
15 | yum makecache fast
16 | yum -y install docker-ce
17 | 
18 | setenforce 0
19 | 
20 | yum install -y ntp
21 | 
22 | systemctl enable docker && systemctl start docker
23 | systemctl enable ntpd && systemctl start ntpd
24 | 
25 | if systemctl -q is-active firewalld; then
26 | 	systemctl stop firewalld
27 | fi
28 | if systemctl -q is-enabled firewalld; then
29 | 	systemctl disable firewalld
30 | fi
31 | usermod -a -G docker $SUDO_USER
32 | 
33 | systemctl stop ntpd
34 | ntpdate 1.ntp.esl.cisco.com || ntpdate pool.ntp.org
35 | systemctl start ntpd
36 | 
37 | exit 0
38 | 


--------------------------------------------------------------------------------
/cluster/docker17/centos_docker_install.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | # This script installs Docker Swarm (Docker CE 17.03.1) on a node.
 4 | # Must be run locally on the node, as root (or with sudo).
 5 | 
 6 | set -euo pipefail
 7 | 
 8 | if [ $EUID -ne 0 ]; then
 9 | 	echo "Please run this script as root user"
10 | 	exit 1
11 | fi
12 | 
13 | # Install pre-reqs
14 | yum makecache fast
15 | yum install -y yum-utils device-mapper-persistent-data lvm2
16 | 
17 | yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
18 | 
19 | # Install Docker
20 | # If you require a specific version, comment out the first line and uncomment
21 | # the other one. Fill in the version you want.
22 | yum -y install docker-ce
23 | #sudo yum install docker-ce-<VERSION>
24 | 
25 | # Post-install steps
26 | # add admin user to docker group
27 | usermod -aG docker $SUDO_USER
28 | 
29 | # add /etc/docker/ if it doesn't exist
30 | mkdir -p /etc/docker
31 | 
32 | # add (and create) daemon.json with entry for storage-device
33 | cat <<EOT >>/etc/docker/daemon.json
34 | {
35 |   "storage-driver": "devicemapper"
36 | }
37 | EOT
38 | 
39 | # start up docker
40 | systemctl enable docker
41 | systemctl start docker
42 | 
43 | # TODO: REMOVE THIS ONCE THE Contiv Installer DOES THIS
44 | # make sure /etc/openvswitch exists
45 | mkdir -p /etc/openvswitch
46 | 
47 | exit 0
48 | 


--------------------------------------------------------------------------------
/cluster/docker17/centos_prep.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | setenforce 0
11 | 
12 | yum install -y bzip2
13 | 
14 | yum install -y ntp
15 | systemctl enable ntpd && systemctl start ntpd
16 | 
17 | if systemctl -q is-active firewalld; then
18 | 	systemctl stop firewalld
19 | fi
20 | if systemctl -q is-enabled firewalld; then
21 | 	systemctl disable firewalld
22 | fi
23 | 
24 | systemctl stop ntpd
25 | ntpdate 1.ntp.esl.cisco.com || ntpdate pool.ntp.org
26 | systemctl start ntpd
27 | 
28 | exit 0
29 | 


--------------------------------------------------------------------------------
/cluster/docker17/master.sh:
--------------------------------------------------------------------------------
1 | docker swarm init --advertise-addr $1
2 | docker swarm join-token manager |
3 | 	grep -A 20 "docker swarm join" >$2/manager.sh
4 | docker swarm join-token worker |
5 | 	grep -A 20 "docker swarm join" >$2/worker.sh
6 | 


--------------------------------------------------------------------------------
/cluster/k8s1.4/bootstrap_centos.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | cat <<EOF >/etc/yum.repos.d/kubernetes.repo
11 | [kubernetes]
12 | name=Kubernetes
13 | baseurl=http://yum.kubernetes.io/repos/kubernetes-el7-x86_64
14 | enabled=1
15 | gpgcheck=0
16 | repo_gpgcheck=0
17 | EOF
18 | 
19 | setenforce 0
20 | 
21 | yum install -y ntp
22 | yum install -y docker ebtables \
23 | 	https://fedorapeople.org/groups/kolla/kubeadm-1.6.0-0.alpha.0.2074.a092d8e0f95f52.x86_64.rpm \
24 | 	https://fedorapeople.org/groups/kolla/kubectl-1.5.4-0.x86_64.rpm \
25 | 	https://fedorapeople.org/groups/kolla/kubelet-1.5.4-0.x86_64.rpm \
26 | 	https://fedorapeople.org/groups/kolla/kubernetes-cni-0.3.0.1-0.07a8a2.x86_64.rpm
27 | 
28 | systemctl enable docker && systemctl start docker
29 | systemctl enable kubelet && systemctl start kubelet
30 | systemctl enable ntpd && systemctl start ntpd
31 | 
32 | if systemctl -q is-active firewalld; then
33 | 	systemctl stop firewalld
34 | fi
35 | if systemctl -q is-enabled firewalld; then
36 | 	systemctl disable firewalld
37 | fi
38 | 
39 | systemctl stop ntpd
40 | ntpdate 1.ntp.esl.cisco.com || ntpdate pool.ntp.org
41 | systemctl start ntpd
42 | 
43 | exit 0
44 | 


--------------------------------------------------------------------------------
/cluster/k8s1.4/bootstrap_ubuntu.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | apt-get update && apt-get install -y apt-transport-https
11 | curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
12 | cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
13 | deb http://apt.kubernetes.io/ kubernetes-xenial main
14 | EOF
15 | apt-get update
16 | # Install docker if you don't have it already.
17 | apt-get install -y docker.io
18 | apt-get install -y kubelet kubeadm kubectl kubernetes-cni
19 | apt-get install -y ntp
20 | 
21 | systemctl enable ntpd && systemctl start ntpd
22 | 
23 | if systemctl -q is-active firewalld; then
24 | 	systemctl stop firewalld
25 | fi
26 | if systemctl -q is-enabled firewalld; then
27 | 	systemctl disable firewalld
28 | fi
29 | 


--------------------------------------------------------------------------------
/cluster/k8s1.4/k8smaster.sh:
--------------------------------------------------------------------------------
1 | kubeadm init --token=$1 --api-advertise-addresses=$2 --skip-preflight-checks=true --use-kubernetes-version $3
2 | 


--------------------------------------------------------------------------------
/cluster/k8s1.4/k8sworker.sh:
--------------------------------------------------------------------------------
1 | kubeadm join --token=$1 --skip-preflight-checks=true $2
2 | 


--------------------------------------------------------------------------------
/cluster/k8s1.6/bootstrap_centos.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | cat <<EOF >/etc/yum.repos.d/kubernetes.repo
11 | [kubernetes]
12 | name=Kubernetes
13 | baseurl=http://yum.kubernetes.io/repos/kubernetes-el7-x86_64
14 | enabled=1
15 | gpgcheck=0
16 | repo_gpgcheck=0
17 | EOF
18 | 
19 | setenforce 0
20 | 
21 | yum install -y docker kubelet-1.6.5-0 kubeadm-1.6.5 kubectl-1.6.5-0 kubernetes-cni-0.5.1 ntp
22 | 
23 | systemctl enable docker && systemctl start docker
24 | systemctl enable kubelet && systemctl start kubelet
25 | systemctl enable ntpd && systemctl start ntpd
26 | 
27 | if systemctl -q is-active firewalld; then
28 | 	systemctl stop firewalld
29 | fi
30 | if systemctl -q is-enabled firewalld; then
31 | 	systemctl disable firewalld
32 | fi
33 | 
34 | systemctl stop ntpd
35 | ntpdate 1.ntp.esl.cisco.com || ntpdate pool.ntp.org
36 | systemctl start ntpd
37 | 
38 | exit 0
39 | 


--------------------------------------------------------------------------------
/cluster/k8s1.6/bootstrap_ubuntu.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | apt-get update && apt-get install -y apt-transport-https
11 | curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
12 | cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
13 | deb http://apt.kubernetes.io/ kubernetes-xenial main
14 | EOF
15 | apt-get update
16 | # Install docker if you don't have it already.
17 | apt-get install -y docker.io
18 | apt-get install -y kubelet kubeadm kubectl kubernetes-cni
19 | apt-get install -y ntp
20 | 
21 | systemctl enable ntpd && systemctl start ntpd
22 | systemctl -q is-active firewalld && systemctl stop firewalld || true
23 | systemctl -q is-enabled firewalld && systemctl disable firewalld || true
24 | 
25 | if systemctl -q is-active firewalld; then
26 | 	systemctl stop firewalld
27 | fi
28 | if systemctl -q is-enabled firewalld; then
29 | 	systemctl disable firewalld
30 | fi
31 | 


--------------------------------------------------------------------------------
/cluster/k8s1.6/k8smaster.sh:
--------------------------------------------------------------------------------
1 | kubeadm init --token=$1 --apiserver-advertise-address=$2 --skip-preflight-checks=true --kubernetes-version $3
2 | if [ "$#" -eq 4 ]; then
3 | 	cp /etc/kubernetes/admin.conf /home/$4
4 | 	chown $(id -u $4):$(id -g $4) /home/$4/admin.conf
5 | 	echo "export KUBECONFIG=/home/$4/admin.conf" >>/home/$4/.$(basename $SHELL)rc
6 | 	echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >>~/.$(basename $SHELL)rc
7 | fi
8 | 


--------------------------------------------------------------------------------
/cluster/k8s1.6/k8sworker.sh:
--------------------------------------------------------------------------------
1 | kubeadm join --token=$1 --skip-preflight-checks=true $2:6443
2 | 


--------------------------------------------------------------------------------
/cluster/k8s1.8/bootstrap_centos.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | cat <<EOF >/etc/yum.repos.d/kubernetes.repo
11 | [kubernetes]
12 | name=Kubernetes
13 | baseurl=http://yum.kubernetes.io/repos/kubernetes-el7-x86_64
14 | enabled=1
15 | gpgcheck=0
16 | repo_gpgcheck=0
17 | EOF
18 | 
19 | setenforce 0
20 | 
21 | swapoff -a
22 | 
23 | yum install -y docker kubeadm-1.8.4 kubectl-1.8.4 kubernetes-cni-1.8.4 ntp
24 | 
25 | systemctl enable docker && systemctl start docker
26 | systemctl enable kubelet && systemctl start kubelet
27 | systemctl enable ntpd && systemctl start ntpd
28 | 
29 | if systemctl -q is-active firewalld; then
30 | 	systemctl stop firewalld
31 | fi
32 | if systemctl -q is-enabled firewalld; then
33 | 	systemctl disable firewalld
34 | fi
35 | 
36 | systemctl stop ntpd
37 | ntpdate 1.ntp.esl.cisco.com || ntpdate pool.ntp.org
38 | systemctl start ntpd
39 | 
40 | exit 0
41 | 


--------------------------------------------------------------------------------
/cluster/k8s1.8/bootstrap_ubuntu.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | if [ $EUID -ne 0 ]; then
 6 | 	echo "Please run this script as root user"
 7 | 	exit 1
 8 | fi
 9 | 
10 | apt-get update && apt-get install -y apt-transport-https
11 | curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
12 | cat <<EOF >/etc/apt/sources.list.d/kubernetes.list
13 | deb http://apt.kubernetes.io/ kubernetes-xenial main
14 | EOF
15 | apt-get update
16 | # Install docker if you don't have it already.
17 | apt-get install -y docker.io
18 | apt-get install -y kubelet kubeadm kubectl kubernetes-cni
19 | apt-get install -y ntp
20 | 
21 | systemctl enable ntpd && systemctl start ntpd
22 | systemctl -q is-active firewalld && systemctl stop firewalld || true
23 | systemctl -q is-enabled firewalld && systemctl disable firewalld || true
24 | 
25 | if systemctl -q is-active firewalld; then
26 | 	systemctl stop firewalld
27 | fi
28 | if systemctl -q is-enabled firewalld; then
29 | 	systemctl disable firewalld
30 | fi
31 | 


--------------------------------------------------------------------------------
/cluster/k8s1.8/k8smaster.sh:
--------------------------------------------------------------------------------
1 | kubeadm init --token-ttl 0 --token=$1 --apiserver-advertise-address=$2 --skip-preflight-checks=true --kubernetes-version $3
2 | if [ "$#" -eq 4 ]; then
3 | 	cp /etc/kubernetes/admin.conf /home/$4
4 | 	chown $(id -u $4):$(id -g $4) /home/$4/admin.conf
5 | 	echo "export KUBECONFIG=/home/$4/admin.conf" >>/home/$4/.$(basename $SHELL)rc
6 | 	echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >>~/.$(basename $SHELL)rc
7 | fi
8 | 


--------------------------------------------------------------------------------
/cluster/k8s1.8/k8sworker.sh:
--------------------------------------------------------------------------------
1 | kubeadm join --token=$1 --skip-preflight-checks=true $2:6443
2 | 


--------------------------------------------------------------------------------
/install/ansible/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM alpine:3.6
2 | 
3 | RUN DEV_PACKAGES="python-dev gcc make musl-dev openssl-dev libffi-dev" \
4 |  && apk add --no-cache bash python openssl libffi netcat-openbsd py-pip $DEV_PACKAGES \
5 |  && pip install --upgrade pip \
6 |  && pip install cffi \
7 |  && pip install ansible==2.3.1.0 \
8 |  && apk del $DEV_PACKAGES
9 | 


--------------------------------------------------------------------------------
/install/ansible/aci_cfg.yml:
--------------------------------------------------------------------------------
 1 | # This is an example configuration for the aci installation
 2 | 
 3 | CONNECTION_INFO:
 4 |       contiv-aci-server4:
 5 |         role: master
 6 |         control: enp3s0f1
 7 |         data: enp130s0f1
 8 |       contiv-aci-server5:
 9 |         control: enp3s0f1
10 |         data: enp130s0f1
11 | APIC_URL: "https://contiv-aci-apic:443"
12 | APIC_USERNAME: "admin"
13 | APIC_PASSWORD: "password"
14 | APIC_LEAF_NODES:
15 |     - topology/pod-1/node-101
16 |     - topology/pod-1/node-102
17 | APIC_PHYS_DOMAIN: "TEST-Phys-Dom"
18 | APIC_EPG_BRIDGE_DOMAIN:  "not_specified"
19 | APIC_CONTRACTS_UNRESTRICTED_MODE: "no"
20 | 


--------------------------------------------------------------------------------
/install/ansible/cfg.yml:
--------------------------------------------------------------------------------
1 | CONNECTION_INFO:
2 |   192.168.2.52:
3 |         role: master
4 |         control: eth1
5 |         data: eth2
6 |   192.168.2.53:
7 |         control: eth1
8 |         data: eth2
9 | 


--------------------------------------------------------------------------------
/install/ansible/env.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "docker_version": "__DOCKER_VERSION__",
 3 |   "aci_gw_image": "contiv/aci-gw:__ACI_GW_VERSION__",
 4 |   "contiv_network_version": "__CONTIV_VERSION__",
 5 |   "env": {},
 6 |   "etcd_peers_group": "netplugin-master",
 7 |   "service_vip": "__NETMASTER_IP__",
 8 |   "validate_certs": false,
 9 |   "cluster_store_driver": "__CLUSTER_STORE_TYPE__",
10 |   "cluster_store_url": "__CLUSTER_STORE_URLS__",
11 |   "auth_proxy_image": "contiv/auth_proxy:__API_PROXY_VERSION__",
12 |   "docker_reset_container_state": __DOCKER_RESET_CONTAINER_STATE__,
13 |   "docker_reset_image_state": __DOCKER_RESET_IMAGE_STATE__,
14 |   "etcd_cleanup_state": __ETCD_CLEANUP_STATE__,
15 |   "auth_proxy_local_install": __AUTH_PROXY_LOCAL_INSTALL__,
16 |   "contiv_network_local_install": __CONTIV_NETWORK_LOCAL_INSTALL__,
17 |   "vxlan_port": __VXLAN_PORT__,
18 |   "netctl_url": "http://__NETMASTER_IP__:9999",
19 |   "contiv_v2plugin_install": __CONTIV_V2PLUGIN_INSTALL__,
20 |   "contiv_v2plugin_image": "contiv/v2plugin:__CONTIV_V2PLUGIN_VERSION__"
21 | }
22 | 


--------------------------------------------------------------------------------
/install/ansible/install.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | set -xeuo pipefail
  4 | 
  5 | # This scripts runs in a container with ansible installed.
  6 | . ./install/ansible/install_defaults.sh
  7 | 
  8 | # Ignore ansible ssh host key checking by default
  9 | export ANSIBLE_HOST_KEY_CHECKING=False
 10 | 
 11 | # Scheduler provider can be in kubernetes or swarm mode
 12 | scheduler_provider=${CONTIV_SCHEDULER_PROVIDER:-"native-swarm"}
 13 | 
 14 | # Specify the etcd or cluster store here
 15 | # If an etcd or consul cluster store is not provided, we will start an etcd instance
 16 | cluster_store=""
 17 | install_etcd=true
 18 | 
 19 | # Should the scheduler stack (docker swarm or k8s be installed)
 20 | install_scheduler=false
 21 | 
 22 | # This is the netmaster IP that needs to be provided for the installation to proceed
 23 | netmaster=""
 24 | contiv_v2plugin_install=""
 25 | 
 26 | usage() {
 27 | 	echo "Usage:"
 28 | 	echo "./install.sh -n <netmaster IP> -a <ansible options> -i <install scheduler stack> -m <network mode - standalone/aci> -d <fwd mode - routing/bridge> -v <ACI image>"
 29 | 	echo "This script is to be launched using the install_swarm.sh script. See the documentation for install_swarm.sh for a detailed description of options."
 30 | 	exit 1
 31 | }
 32 | 
 33 | # Return printing the error
 34 | error_ret() {
 35 | 	echo ""
 36 | 	echo "$1"
 37 | 	exit 1
 38 | }
 39 | 
 40 | while getopts ":n:a:im:d:v:pe:c:s:" opt; do
 41 | 	case $opt in
 42 | 	n)
 43 | 		netmaster=$OPTARG
 44 | 		;;
 45 | 	a)
 46 | 		# make a bash array from the ansible argument
 47 | 		# it interprets single and double quotes from CLI as you might expect
 48 | 		# creating proper bash "words" for eventually passing to ansible
 49 | 		# by letting the array declaration do all the interpreting
 50 | 		# note: ans_opts=($OPTARG) and ans_opts("$OPTARG") do not work
 51 | 		# Example:
 52 | 		#   "-v --ssh-common-args=\"-o ProxyCommand='nc -x 192.168.2.1 %h %p'\"
 53 | 		declare -a 'ans_opts=('"$OPTARG"')'
 54 | 		;;
 55 | 	i)
 56 | 		install_scheduler=true
 57 | 		;;
 58 | 	m)
 59 | 		contiv_network_mode=$OPTARG
 60 | 		;;
 61 | 	d)
 62 | 		fwd_mode=$OPTARG
 63 | 		;;
 64 | 	v)
 65 | 		aci_image=$OPTARG
 66 | 		;;
 67 | 	p)
 68 | 		contiv_v2plugin_install=true
 69 | 		;;
 70 | 	e)
 71 | 		# etcd endpoint option
 72 | 		cluster_store_type=etcd
 73 | 		cluster_store_urls=$OPTARG
 74 | 		install_etcd=false
 75 | 		;;
 76 | 	c)
 77 | 		# consul endpoint option
 78 | 		cluster_store_type=consul
 79 | 		cluster_store_urls=$OPTARG
 80 | 		install_etcd=false
 81 | 		;;
 82 | 	s)
 83 | 		# backward compatibility
 84 | 		echo "-s option has been deprecated, use -e or -c instead"
 85 | 		local cluster_store=$OPTARG
 86 | 		if [[ "$cluster_store" =~ ^etcd://.+ ]]; then
 87 | 			cluster_store_type=etcd
 88 | 			cluster_store_urls=$(echo $cluster_store | sed s/etcd/http/)
 89 | 		elif [[ "$cluster_store" =~ ^consul://.+ ]]; then
 90 | 			cluster_store_type=consul
 91 | 			cluster_store_urls=$(echo $cluster_store | sed s/consul/http/)
 92 | 		fi
 93 | 		install_etcd=false
 94 | 		;;
 95 | 	:)
 96 | 		echo "An argument required for $OPTARG was not passed"
 97 | 		usage
 98 | 		;;
 99 | 	?)
100 | 		usage
101 | 		;;
102 | 	esac
103 | done
104 | 
105 | echo "Generating Ansible configuration"
106 | inventory="/.gen"
107 | inventory_log="/var/contiv/host_inventory.log"
108 | mkdir -p "$inventory"
109 | host_inventory="$inventory/contiv_hosts"
110 | node_info="$inventory/contiv_nodes"
111 | 
112 | # TODO: use python to generate the inventory
113 | # This python generated inventory contains
114 | # 1. groups and host
115 | # 2. ssh info for each host
116 | # 3. control interface for each host
117 | # 4. data interface for each host
118 | # 5. aci info
119 | # 6. fwd_mode(bridge/routing), net_mode(vlan/vxlan), contiv_network_mode(standalone/aci)
120 | # then below sed against env_file set rest of them, they should be combined as one
121 | ./install/genInventoryFile.py "$contiv_config" "$host_inventory" "$node_info" $contiv_network_mode $fwd_mode
122 | 
123 | if [ "$netmaster" = "" ]; then
124 | 	# Use the first master node as netmaster
125 | 	netmaster=$(grep -A 5 netplugin-master "$host_inventory" | grep -m 1 ansible_ssh_host | awk '{print $2}' | awk -F "=" '{print $2}' | xargs)
126 | 	echo "Using $netmaster as the master node"
127 | fi
128 | 
129 | if [ "$netmaster" = "" ]; then
130 | 	usage
131 | fi
132 | 
133 | if [ "$install_scheduler" = "true" ] && [ "$contiv_v2plugin_install" = "true" ]; then
134 | 	echo "ERROR: -p and -i are mutually exclusive"
135 | 	usage
136 | fi
137 | 
138 | ansible_path=./ansible
139 | env_file=install/ansible/env.json
140 | # Verify ansible can reach all hosts
141 | 
142 | echo "Verifying ansible reachability"
143 | ansible all "${ans_opts[@]}" -i $host_inventory -m setup -a 'filter=ansible_distribution*' | tee $inventory_log
144 | if egrep -q 'FAIL|UNREACHABLE' $inventory_log; then
145 | 	echo "WARNING Some of the hosts are not accessible via passwordless SSH"
146 | 	echo " "
147 | 	echo "This means either the host is unreachable or passwordless SSH is not"
148 | 	echo "set up for it. Please resolve this before proceeding."
149 | 
150 | 	exit 1
151 | fi
152 | 
153 | # Get the netmaster control interface
154 | netmaster_control_if=$(grep -A10 $netmaster $contiv_config | grep -m 1 control | awk -F ":" '{print $2}' | xargs)
155 | # Get the ansible node
156 | node_name=$(grep $netmaster $host_inventory | awk '{print $1}' | xargs)
157 | # Get the service VIP for netmaster for the control interface
158 | service_vip=$(ansible $node_name -m setup "${ans_opts[@]}" -i $host_inventory | grep -A 100 ansible_$netmaster_control_if | grep -A 4 ipv4 | grep address | awk -F \" '{print $4}' | xargs)
159 | 
160 | if [ "$service_vip" == "" ]; then
161 | 	service_vip=$netmaster
162 | fi
163 | 
164 | if [ "$cluster_store" = "" ]; then
165 | 	cluster_store_type="etcd"
166 | 	cluster_store_urls="http://localhost:2379"
167 | fi
168 | 
169 | # variables already replaced by build.sh will not pattern match
170 | sed -i.bak 's#__NETMASTER_IP__#'"$service_vip"'#g' "$env_file"
171 | sed -i.bak 's#__CLUSTER_STORE_TYPE__#'"$cluster_store_type"'#g' "$env_file"
172 | sed -i.bak 's#__CLUSTER_STORE_URLS__#'"$cluster_store_urls"'#g' "$env_file"
173 | sed -i.bak 's#__DOCKER_RESET_CONTAINER_STATE__#false#g' "$env_file"
174 | sed -i.bak 's#__DOCKER_RESET_IMAGE_STATE__#false#g' "$env_file"
175 | sed -i.bak 's#__ETCD_CLEANUP_STATE__#false#g' "$env_file"
176 | sed -i.bak 's#__AUTH_PROXY_LOCAL_INSTALL__#false#g' "$env_file"
177 | sed -i.bak 's#__CONTIV_NETWORK_LOCAL_INSTALL__#false#g' "$env_file"
178 | 
179 | # Copy certs
180 | cp /var/contiv/cert.pem /ansible/roles/auth_proxy/files/
181 | cp /var/contiv/key.pem /ansible/roles/auth_proxy/files/
182 | 
183 | if [ "$aci_image" != "" ]; then
184 | 	sed -i.bak 's#__ACI_GW_VERSION__#'"$aci_image"'#g' "$env_file"
185 | fi
186 | if [ "$contiv_v2plugin_install" == "true" ]; then
187 | 	# docker uses 4789 port for container ingress network, uses 8472 by default to avoid conflicting
188 | 	# https://docs.docker.com/engine/swarm/ingress/
189 | 	sed -i.bak 's#__VXLAN_PORT__#8472#g' "$env_file"
190 | 	sed -i.bak 's#__CONTIV_V2PLUGIN_INSTALL__#true#g' "$env_file"
191 | else
192 | 	sed -i.bak 's#__VXLAN_PORT__#4789#g' "$env_file"
193 | 	sed -i.bak 's#__CONTIV_V2PLUGIN_INSTALL__#false#g' "$env_file"
194 | fi
195 | 
196 | echo "Installing Contiv"
197 | # Always install the base, install the scheduler stack/etcd if required
198 | 
199 | rm -f $ansible_path/install_plays.yml
200 | touch $ansible_path/install_plays.yml
201 | 
202 | if [ "$install_scheduler" == "true" ]; then
203 | 	echo '- include: install_base.yml' >$ansible_path/install_plays.yml
204 | 	echo '- include: install_docker.yml' >>$ansible_path/install_plays.yml
205 | 	echo '- include: install_etcd.yml' >>$ansible_path/install_plays.yml
206 | 	echo '- include: install_scheduler.yml' >>$ansible_path/install_plays.yml
207 | else
208 | 	if [ "$install_etcd" == "true" ]; then
209 | 		echo '- include: install_etcd.yml' >$ansible_path/install_plays.yml
210 | 	fi
211 | fi
212 | # Install contiv & API Proxy
213 | echo '- include: install_contiv.yml' >>$ansible_path/install_plays.yml
214 | echo '- include: install_auth_proxy.yml' >>$ansible_path/install_plays.yml
215 | 
216 | log_file_name="contiv_install_$(date -u +%m-%d-%Y.%H-%M-%S.UTC).log"
217 | log_file="/var/contiv/$log_file_name"
218 | 
219 | echo "Ansible extra vars from env.json:"
220 | cat "$env_file"
221 | # run playbook
222 | ansible-playbook "${ans_opts[@]}" -i "$host_inventory" -e@"$env_file" $ansible_path/install_plays.yml | tee $log_file
223 | rm -rf "$env_file.bak"
224 | 
225 | unreachable=$(grep "PLAY RECAP" -A 9999 $log_file | awk -F "unreachable=" '{print $2}' | awk '{print $1}' | grep -v "0" | xargs)
226 | failed=$(grep "PLAY RECAP" -A 9999 $log_file | awk -F "failed=" '{print $2}' | awk '{print $1}' | grep -v "0" | xargs)
227 | chmod 666 $inventory_log
228 | chmod 666 $env_file
229 | chmod 666 $log_file
230 | 
231 | set +x
232 | 
233 | if [ "$unreachable" = "" ] && [ "$failed" = "" ]; then
234 | 	echo "Installation is complete"
235 | 	echo "========================================================="
236 | 	echo " "
237 | 	echo "Please export DOCKER_HOST=tcp://$netmaster:2375 in your shell before proceeding"
238 | 	echo "Contiv UI is available at https://$netmaster:10000"
239 | 	echo "Please use the first run wizard or configure the setup as follows:"
240 | 	echo " Configure ACI mode (optional)"
241 | 	echo " netctl global set --fabric-mode aci --vlan-range <start>-<end>"
242 | 	echo " Create a default network"
243 | 	echo " netctl net create -t default --subnet=<CIDR> default-net"
244 | 	echo " For example, netctl net create -t default --subnet=20.1.1.0/24 default-net"
245 | 	echo " "
246 | 	echo "========================================================="
247 | 	exit 0
248 | else
249 | 	echo "Installation failed"
250 | 	echo "========================================================="
251 | 	echo " Please check ./config/$log_file_name for errors."
252 | 	echo "========================================================="
253 | 	exit 1
254 | fi
255 | 


--------------------------------------------------------------------------------
/install/ansible/install_defaults.sh:
--------------------------------------------------------------------------------
 1 | src_conf_path=$(pwd)/config
 2 | container_conf_path=/var/contiv
 3 | 
 4 | # These paths are in the installer container
 5 | contiv_config=$container_conf_path/cfg.yml
 6 | tls_cert=$container_conf_path/cert.pem
 7 | tls_key=$container_conf_path/key.pem
 8 | def_ans_key=$container_conf_path/insecure_private_key
 9 | 
10 | # These paths are on the host
11 | host_contiv_config=$src_conf_path/cfg.yml
12 | host_tls_cert=$src_conf_path/cert.pem
13 | host_tls_key=$src_conf_path/key.pem
14 | host_ans_key=$src_conf_path/insecure_private_key
15 | 
16 | # Network mode can be "standalone" or "aci"
17 | contiv_network_mode="standalone"
18 | # Forwarding mode can be "bridge" or "routing"
19 | fwd_mode="bridge"
20 | 
21 | aci_image=""
22 | 


--------------------------------------------------------------------------------
/install/ansible/install_swarm.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | set -euo pipefail
  4 | 
  5 | # This is the installation script for Contiv.
  6 | 
  7 | . ./install/ansible/install_defaults.sh
  8 | 
  9 | # Ansible options. By default, this specifies a private key to be used and the vagrant user
 10 | ans_opts=""
 11 | ans_user="root"
 12 | ans_key=$src_conf_path/insecure_private_key
 13 | install_scheduler=""
 14 | netmaster=""
 15 | v2plugin_param=""
 16 | contiv_v2plugin_install=""
 17 | 
 18 | # Check for docker
 19 | 
 20 | if ! docker version >/dev/null 2>&1; then
 21 | 	echo "docker not found or is not running."
 22 | 	echo "Please ensure docker is installed and running before retrying."
 23 | 	exit 1
 24 | fi
 25 | 
 26 | usage() {
 27 | 	cat <<EOF
 28 | Contiv Installer for Docker/Swarm based setups.
 29 | 
 30 | Installer:
 31 | Usage: ./install/ansible/install_swarm.sh OPTIONS
 32 | 
 33 | Mandatory Options:
 34 | -f   string     Configuration file (cfg.yml) listing the hostnames with the control and data interfaces and optionally ACI parameters
 35 | -e   string     SSH key to connect to the hosts
 36 | -u   string     SSH User
 37 | -i              Install the scheduler stack
 38 | -p              Install v2plugin
 39 | 
 40 | Additional Options:
 41 | -m   string     Network Mode for the Contiv installation (“standalone” or “aci”). Default mode is “standalone” and should be used for non ACI-based setups
 42 | -d   string     Forwarding mode (“routing” or “bridge”). Default mode is “bridge”
 43 | -c   string
 44 | -k   string
 45 | -a   string     Additonal ansible arguments such as "-v --ssh-common-args=\"-o ProxyCommand='nc -x 192.168.2.1 %h %p'\""
 46 | 
 47 | Advanced Options:
 48 | -v   string     ACI Image (default is contiv/aci-gw:latest). Use this to specify a specific version of the ACI Image.
 49 | -n   string     DNS name/IP address of the host to be used as the net master service VIP. This must be a host present in the cfg.yml file.
 50 | -s   string     URL of the cluster store to be used (for example etcd://etcd master or netmaster IP:2379)
 51 | Additional parameters can also be updated in install/ansible/env.json file.
 52 | 
 53 | Examples:
 54 | 
 55 | 1. Install Contiv with Docker Swarm on hosts specified by cfg.yml.
 56 | ./install/ansible/install_swarm.sh -f cfg.yml -e ~/ssh_key -u admin -i
 57 | 
 58 | 2. Install Contiv on hosts specified by cfg.yml. Docker should be pre-installed on the hosts.
 59 | ./install/ansible/install_swarm.sh -f cfg.yml -e ~/ssh_key -u admin
 60 | 
 61 | 3. Install Contiv with Docker Swarm on hosts specified by cfg.yml in ACI mode.
 62 | ./install/ansible/install_swarm.sh -f cfg.yml -e ~/ssh_key -u admin -i -m aci
 63 | 
 64 | 4. Install Contiv with Docker Swarm on hosts specified by cfg.yml in ACI mode, using routing as the forwarding mode.
 65 | ./install/ansible/install_swarm.sh -f cfg.yml -e ~/ssh_key -u admin -i -m aci -d routing
 66 | 
 67 | EOF
 68 | 	exit 1
 69 | }
 70 | 
 71 | # Create the config folder to be shared with the install container.
 72 | mkdir -p "$src_conf_path"
 73 | cluster_param=""
 74 | while getopts ":f:n:a:e:ipm:d:v:u:c:k:s:" opt; do
 75 | 	case $opt in
 76 | 	f)
 77 | 		cp "$OPTARG" "$host_contiv_config"
 78 | 		;;
 79 | 	n)
 80 | 		netmaster=$OPTARG
 81 | 		;;
 82 | 	a)
 83 | 		ans_opts="$OPTARG"
 84 | 		;;
 85 | 	e)
 86 | 		ans_key=$OPTARG
 87 | 		;;
 88 | 	u)
 89 | 		ans_user=$OPTARG
 90 | 		;;
 91 | 	m)
 92 | 		contiv_network_mode=$OPTARG
 93 | 		;;
 94 | 	d)
 95 | 		fwd_mode=$OPTARG
 96 | 		;;
 97 | 	v)
 98 | 		aci_image=$OPTARG
 99 | 		;;
100 | 	s)
101 | 		cluster_param="-s $OPTARG"
102 | 		;;
103 | 
104 | 	i)
105 | 		install_scheduler="-i"
106 | 		;;
107 | 	p)
108 | 		v2plugin_param="-p"
109 | 		;;
110 | 	c)
111 | 		cp "$OPTARG" "$host_tls_cert"
112 | 		;;
113 | 	k)
114 | 		cp "$OPTARG" "$host_tls_key"
115 | 		;;
116 | 	:)
117 | 		echo "An argument required for $OPTARG was not passed"
118 | 		usage
119 | 		;;
120 | 	?)
121 | 		usage
122 | 		;;
123 | 	esac
124 | done
125 | 
126 | if [[ ! -f $host_contiv_config ]]; then
127 | 	echo "Host configuration file missing"
128 | 	usage
129 | fi
130 | 
131 | if [ "$netmaster" != "" ]; then
132 | 	netmaster_param="-n $netmaster"
133 | else
134 | 	netmaster_param=""
135 | fi
136 | 
137 | if [ "$aci_image" != "" ]; then
138 | 	aci_param="-v $aci_image"
139 | else
140 | 	aci_param=""
141 | fi
142 | 
143 | # Copy the key to config folder
144 | if [[ -f $ans_key ]]; then
145 | 	cp "$ans_key" "$host_ans_key"
146 | fi
147 | 
148 | if [ "$ans_opts" == "" ]; then
149 | 	ans_opts="--private-key $def_ans_key -u $ans_user"
150 | else
151 | 	ans_opts+=" --private-key $def_ans_key -u $ans_user"
152 | fi
153 | 
154 | # Generate SSL certs for auth proxy
155 | if [[ ! -f "$host_tls_cert" || ! -f "$host_tls_key" ]]; then
156 | 	echo "Generating local certs for Contiv Proxy"
157 | 	openssl genrsa -out "$host_tls_key" 2048 >/dev/null 2>&1
158 | 	openssl req -new -x509 -sha256 -days 3650 \
159 | 		-key "$host_tls_key" \
160 | 		-out "$host_tls_cert" \
161 | 		-subj "/C=US/ST=CA/L=San Jose/O=CPSG/OU=IT Department/CN=auth-local.cisco.com"
162 | fi
163 | 
164 | echo "Starting the installer container"
165 | image_name="__CONTIV_INSTALL_VERSION__"
166 | mounts[0]="-v"
167 | mounts[1]="$(pwd)/install:/install:Z"
168 | mounts[2]="-v"
169 | mounts[3]="$(pwd)/ansible:/ansible:Z"
170 | mounts[4]="-v"
171 | mounts[5]="$src_conf_path:$container_conf_path:Z"
172 | mounts[6]="-v"
173 | mounts[7]="$(pwd)/contiv_cache:/var/contiv_cache:Z"
174 | set -x
175 | docker run --rm --net=host "${mounts[@]}" $image_name ./install/ansible/install.sh \
176 | 	$netmaster_param -a "$ans_opts" $install_scheduler -m $contiv_network_mode \
177 | 	-d $fwd_mode $aci_param $cluster_param $v2plugin_param
178 | 


--------------------------------------------------------------------------------
/install/ansible/uninstall.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/sh
  2 | 
  3 | set -xeuo pipefail
  4 | # This scripts runs in a container with ansible installed.
  5 | . ./install/ansible/install_defaults.sh
  6 | 
  7 | # Ignore ansible ssh host key checking by default
  8 | export ANSIBLE_HOST_KEY_CHECKING=False
  9 | 
 10 | # Scheduler provider can be in kubernetes or swarm mode
 11 | scheduler_provider=${CONTIV_SCHEDULER_PROVIDER:-"native-swarm"}
 12 | 
 13 | # Specify the etcd or cluster store here
 14 | # If an etcd or consul cluster store is not provided, we will start an etcd instance
 15 | cluster_store=""
 16 | 
 17 | # Should the scheduler stack (docker swarm or k8s be uninstalled)
 18 | uninstall_scheduler=false
 19 | uninstall_v2plugin=false
 20 | reset="false"
 21 | reset_images="false"
 22 | 
 23 | # This is the netmaster IP that needs to be provided for the installation to proceed
 24 | netmaster=""
 25 | 
 26 | usage() {
 27 | 	echo "Usage:"
 28 | 	echo "./uninstall.sh -n <netmaster IP> -a <ansible options> -i <uninstall scheduler stack> -m <network mode - standalone/aci> -d <fwd mode - routing/bridge> -v <ACI image>  -r <cleanup containers/etcd state> -g <cleanup docker images>"
 29 | 	echo "This script is to be launched using the uninstall_swarm.sh script. See the documentation for uninstall_swarm.sh for a detailed description of options."
 30 | 	echo ""
 31 | 	exit 1
 32 | }
 33 | 
 34 | # Return printing the error
 35 | error_ret() {
 36 | 	echo ""
 37 | 	echo "$1"
 38 | 	exit 1
 39 | }
 40 | 
 41 | while getopts ":n:a:ipm:d:v:rgs:" opt; do
 42 | 	case $opt in
 43 | 	n)
 44 | 		netmaster=$OPTARG
 45 | 		;;
 46 | 	a)
 47 | 		ans_opts=$OPTARG
 48 | 		;;
 49 | 	i)
 50 | 		uninstall_scheduler=true
 51 | 		;;
 52 | 	p)
 53 | 		uninstall_v2plugin=true
 54 | 		;;
 55 | 	m)
 56 | 		contiv_network_mode=$OPTARG
 57 | 		;;
 58 | 	d)
 59 | 		fwd_mode=$OPTARG
 60 | 		;;
 61 | 	v)
 62 | 		aci_image=$OPTARG
 63 | 		;;
 64 | 	s)
 65 | 		cluster_store=$OPTARG
 66 | 		;;
 67 | 	r)
 68 | 		reset="true"
 69 | 		;;
 70 | 	g)
 71 | 		reset_images="true"
 72 | 		;;
 73 | 	:)
 74 | 		echo "An argument required for $OPTARG was not passed"
 75 | 		usage
 76 | 		;;
 77 | 	?)
 78 | 		usage
 79 | 		;;
 80 | 	esac
 81 | done
 82 | 
 83 | echo "Generating Ansible configuration"
 84 | inventory="/.gen"
 85 | inventory_log="/var/contiv/host_inventory.log"
 86 | mkdir -p "$inventory"
 87 | host_inventory="$inventory/contiv_hosts"
 88 | node_info="$inventory/contiv_nodes"
 89 | 
 90 | ./install/genInventoryFile.py "$contiv_config" "$host_inventory" "$node_info" $contiv_network_mode $fwd_mode
 91 | 
 92 | if [ "$netmaster" = "" ]; then
 93 | 	# Use the first master node as netmaster
 94 | 	netmaster=$(grep -A 5 netplugin-master "$host_inventory" | grep -m 1 ansible_ssh_host | awk '{print $2}' | awk -F "=" '{print $2}' | xargs)
 95 | 	echo "Using $netmaster as the master node"
 96 | fi
 97 | 
 98 | if [ "$netmaster" = "" ]; then
 99 | 	usage
100 | fi
101 | 
102 | ansible_path=./ansible
103 | env_file=install/ansible/env.json
104 | # Verify ansible can reach all hosts
105 | 
106 | echo "Verifying ansible reachability"
107 | ansible all -vvv $ans_opts -i $host_inventory -m setup -a 'filter=ansible_distribution*' | tee $inventory_log
108 | if [ egrep 'FAIL|UNREACHABLE' $inventory_log ] >/dev/null; then
109 | 	echo "WARNING Some of the hosts are not accessible via passwordless SSH"
110 | 	echo " "
111 | 	echo "This means either the host is unreachable or passwordless SSH is not"
112 | 	echo "set up for it. Please resolve this before proceeding."
113 | 
114 | 	exit 1
115 | fi
116 | 
117 | # Get the netmaster control interface
118 | netmaster_control_if=$(grep -A10 $netmaster $contiv_config | grep -m 1 control | awk -F ":" '{print $2}' | xargs)
119 | # Get the ansible node
120 | node_name=$(grep $netmaster $host_inventory | awk '{print $1}' | xargs)
121 | # Get the service VIP for netmaster for the control interface
122 | service_vip=$(ansible $node_name -m setup $ans_opts -i $host_inventory | grep -A 100 ansible_$netmaster_control_if | grep -A 4 ipv4 | grep address | awk -F \" '{print $4}' | xargs)
123 | 
124 | if [ "$service_vip" == "" ]; then
125 | 	service_vip=$netmaster
126 | fi
127 | if [ "$cluster_store" == "" ]; then
128 | 	cluster_store="etcd://$service_vip:2379"
129 | fi
130 | 
131 | sed -i.bak 's#__NETMASTER_IP__#'"$service_vip"'#g' "$env_file"
132 | sed -i.bak 's#__CLUSTER_STORE__#'"$cluster_store"'#g' "$env_file"
133 | 
134 | sed -i.bak 's#__DOCKER_RESET_CONTAINER_STATE__#'"$reset"'#g' "$env_file"
135 | sed -i.bak 's#__DOCKER_RESET_IMAGE_STATE__#'"$reset_images"'#g' "$env_file"
136 | sed -i.bak 's#__ETCD_CLEANUP_STATE__#'"$reset"'#g' "$env_file"
137 | sed -i.bak 's#__AUTH_PROXY_LOCAL_INSTALL__#false#g' "$env_file"
138 | sed -i.bak 's#__CONTIV_NETWORK_LOCAL_INSTALL__#false#g' "$env_file"
139 | sed -i.bak 's#__AUTH_PROXY_LOCAL_INSTALL__#false#g' "$env_file"
140 | sed -i.bak 's#__CONTIV_NETWORK_LOCAL_INSTALL__#false#g' "$env_file"
141 | 
142 | if [ "$aci_image" != "" ]; then
143 | 	sed -i.bak 's#__ACI_GW_VERSION__#'"$aci_image"'#g' "$env_file"
144 | fi
145 | if [ "$uninstall_v2plugin" == "true" ]; then
146 | 	sed -i.bak 's#__CONTIV_V2PLUGIN_INSTALL__#true#g' "$env_file"
147 | else
148 | 	sed -i.bak 's#__CONTIV_V2PLUGIN_INSTALL__#false#g' "$env_file"
149 | fi
150 | 
151 | echo "Uninstalling Contiv"
152 | rm -f $ansible_path/uninstall_plays.yml
153 | 
154 | # Uninstall contiv & API Proxy
155 | echo '- include: uninstall_auth_proxy.yml' >$ansible_path/uninstall_plays.yml
156 | echo '- include: uninstall_contiv.yml' >>$ansible_path/uninstall_plays.yml
157 | 
158 | if [ $uninstall_scheduler == true ]; then
159 | 	echo '- include: uninstall_scheduler.yml' >>$ansible_path/uninstall_plays.yml
160 | 	echo '- include: uninstall_etcd.yml' >>$ansible_path/uninstall_plays.yml
161 | 	echo '- include: uninstall_docker.yml' >>$ansible_path/uninstall_plays.yml
162 | else
163 | 	if [ "$cluster_store" == "" ]; then
164 | 		echo '- include: uninstall_etcd.yml' >>$ansible_path/uninstall_plays.yml
165 | 	fi
166 | fi
167 | log_file_name="contiv_uninstall_$(date -u +%m-%d-%Y.%H-%M-%S.UTC).log"
168 | log_file="/var/contiv/$log_file_name"
169 | 
170 | echo "Ansible extra vars from env.json:"
171 | cat "$env_file"
172 | ansible-playbook $ans_opts -i "$host_inventory" -e@"$env_file" $ansible_path/uninstall_plays.yml | tee $log_file
173 | 
174 | rm -rf "$env_file.bak"
175 | 
176 | unreachable=$(grep "PLAY RECAP" -A 9999 $log_file | awk -F "unreachable=" '{print $2}' | awk '{print $1}' | grep -v "0" | xargs)
177 | failed=$(grep "PLAY RECAP" -A 9999 $log_file | awk -F "failed=" '{print $2}' | awk '{print $1}' | grep -v "0" | xargs)
178 | chmod 666 $inventory_log
179 | chmod 666 $env_file
180 | chmod 666 $log_file
181 | 
182 | set +x
183 | 
184 | if [ "$unreachable" = "" ] && [ "$failed" = "" ]; then
185 | 	echo "Uninstallation is complete"
186 | 	exit 0
187 | else
188 | 	echo "Uninstallation failed"
189 | 	echo "========================================================="
190 | 	echo " Please check ./config/$log_file_name for errors."
191 | 	echo "========================================================="
192 | 	exit 1
193 | fi
194 | 


--------------------------------------------------------------------------------
/install/ansible/uninstall_swarm.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | set -euo pipefail
  4 | 
  5 | # This is the uninstall script for Contiv.
  6 | 
  7 | . ./install/ansible/install_defaults.sh
  8 | 
  9 | # Ansible options. By default, this specifies a private key to be used and the vagrant user
 10 | ans_opts=""
 11 | ans_user="root"
 12 | ans_key=$src_conf_path/insecure_private_key
 13 | uninstall_scheduler=""
 14 | netmaster=""
 15 | uninstall_v2plugin=""
 16 | reset_params=""
 17 | 
 18 | # Check for docker
 19 | 
 20 | if ! docker version >/dev/null 2>&1; then
 21 | 	echo "docker not found. Please retry after installing docker."
 22 | 	exit 1
 23 | fi
 24 | 
 25 | usage() {
 26 | 	cat <<EOF
 27 | Uninstaller:
 28 | Usage: ./install/ansible/uninstall_swarm.sh OPTIONS
 29 | 
 30 | Mandatory Options:
 31 | -f   string     Configuration file (cfg.yml) listing the hostnames with the control and data interfaces and optionally ACI parameters
 32 | -e   string     SSH key to connect to the hosts
 33 | -u   string     SSH User
 34 | -i              Uninstall the scheduler stack 
 35 | -p              Uninstall v2plugin
 36 | 
 37 | Additional Options:
 38 | -m   string     Network Mode for the Contiv installation (“standalone” or “aci”). Default mode is “standalone” and should be used for non ACI-based setups
 39 | -d   string     Forwarding mode (“routing” or “bridge”). Default mode is “bridge”
 40 | Advanced Options:
 41 | -v   string     ACI Image (default is contiv/aci-gw:latest). Use this to specify a specific version of the ACI Image.
 42 | -n   string     DNS name/IP address of the host to be used as the net master service VIP. This must be a host present in the cfg.yml file.
 43 | -r              Reset etcd state and remove docker containers
 44 | -g              Remove docker images
 45 | -s   string     URL of the cluster store to be used (for example etcd://etcd master or netmaster IP:2379)
 46 | Additional parameters can also be updated in install/ansible/env.json file.
 47 | -a   string     Additonal ansible arguments such as "-v --ssh-common-args=\"-o ProxyCommand='nc -x 192.168.2.1 %h %p'\""
 48 | 
 49 | Examples:
 50 | 1. Uninstall Contiv and Docker Swarm on hosts specified by cfg.yml. 
 51 | ./install/ansible/uninstall_swarm.sh -f cfg.yml -e ~/ssh_key -u admin -i
 52 | 
 53 | 2. Uninstall Contiv and Docker Swarm on hosts specified by cfg.yml for an ACI setup.
 54 | ./install/ansible/uninstall_swarm.sh -f cfg.yml -e ~/ssh_key -u admin -i -m aci
 55 | 
 56 | 3. Uninstall Contiv and Docker Swarm on hosts specified by cfg.yml for an ACI setup, remove all containers and Contiv etcd state
 57 | ./install/ansible/uninstall_swarm.sh -f cfg.yml -e ~/ssh_key -u admin -i -m aci -r
 58 | 
 59 | EOF
 60 | 	exit 1
 61 | }
 62 | 
 63 | # Create the config folder to be shared with the install container.
 64 | mkdir -p "$src_conf_path"
 65 | cluster_param=""
 66 | while getopts ":f:n:a:e:ipm:d:v:u:rgs:" opt; do
 67 | 	case $opt in
 68 | 	f)
 69 | 		cp "$OPTARG" "$host_contiv_config"
 70 | 		;;
 71 | 	n)
 72 | 		netmaster=$OPTARG
 73 | 		;;
 74 | 	a)
 75 | 		ans_opts="$OPTARG"
 76 | 		;;
 77 | 	e)
 78 | 		ans_key=$OPTARG
 79 | 		;;
 80 | 	u)
 81 | 		ans_user=$OPTARG
 82 | 		;;
 83 | 	m)
 84 | 		contiv_network_mode=$OPTARG
 85 | 		;;
 86 | 	d)
 87 | 		fwd_mode=$OPTARG
 88 | 		;;
 89 | 	v)
 90 | 		aci_image=$OPTARG
 91 | 		;;
 92 | 	s)
 93 | 		cluster_param="-s $OPTARG"
 94 | 		;;
 95 | 
 96 | 	i)
 97 | 		echo "Uninstalling docker will fail if the uninstallation is being run from a node in the cluster."
 98 | 		echo "Press Ctrl+C to cancel the uininstall and start it from a host outside the cluster."
 99 | 		echo "Uninstalling Contiv, Docker and Swarm in 20 seconds"
100 | 		sleep 20
101 | 		uninstall_scheduler="-i"
102 | 		;;
103 | 	p)
104 | 		uninstall_v2plugin="-p"
105 | 		;;
106 | 	r)
107 | 		reset_params="-r $reset_params"
108 | 		;;
109 | 	g)
110 | 		reset_params="-g $reset_params"
111 | 		;;
112 | 	:)
113 | 		echo "An argument required for $OPTARG was not passed"
114 | 		usage
115 | 		;;
116 | 	?)
117 | 		usage
118 | 		;;
119 | 	esac
120 | done
121 | 
122 | if [[ ! -f $host_contiv_config ]]; then
123 | 	echo "Host configuration file missing"
124 | 	usage
125 | fi
126 | 
127 | if [ "$netmaster" != "" ]; then
128 | 	netmaster_param="-n $netmaster"
129 | else
130 | 	netmaster_param=""
131 | fi
132 | 
133 | if [ "$aci_image" != "" ]; then
134 | 	aci_param="-v $aci_image"
135 | else
136 | 	aci_param=""
137 | fi
138 | 
139 | # Copy the key to config folder
140 | if [[ -f $ans_key ]]; then
141 | 	cp "$ans_key" "$host_ans_key"
142 | fi
143 | 
144 | if [ "$ans_opts" == "" ]; then
145 | 	ans_opts="--private-key $def_ans_key -u $ans_user"
146 | else
147 | 	# escape each word in the array and put spaces between the words
148 | 	ans_opts+=" --private-key $def_ans_key -u $ans_user"
149 | fi
150 | echo "Starting the uninstaller container"
151 | image_name="__CONTIV_INSTALL_VERSION__"
152 | install_mount="-v $(pwd)/install:/install:Z"
153 | ansible_mount="-v $(pwd)/ansible:/ansible:Z"
154 | config_mount="-v $src_conf_path:$container_conf_path:Z"
155 | cache_mount="-v $(pwd)/contiv_cache:/var/contiv_cache:Z"
156 | mounts="$install_mount $ansible_mount $cache_mount $config_mount"
157 | docker run --rm --net=host $mounts $image_name ./install/ansible/uninstall.sh $netmaster_param -a "$ans_opts" $uninstall_scheduler $uninstall_v2plugin -m $contiv_network_mode -d $fwd_mode $aci_param $reset_params $cluster_param
158 | 


--------------------------------------------------------------------------------
/install/genInventoryFile.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | 
  3 | import sys
  4 | import yaml
  5 | 
  6 | NW_MODE_STANDALONE = 'standalone'
  7 | NW_MODE_ACI = 'aci'
  8 | 
  9 | class SafeDict(dict):
 10 |     'Provide a default value for missing keys'
 11 |     def __missing__(self, key):
 12 |         return 'missing'
 13 | 
 14 | class Inventory:
 15 |     groupName = "netplugin-node"
 16 |     masterGroupName = "netplugin-master"
 17 |     workerGroupName = "netplugin-worker"
 18 | 
 19 |     def __init__(self, args):
 20 |         self.cfgFile = args[0]
 21 |         self.inventoryFile = args[1]
 22 |         self.nodeInfoFile = args[2]
 23 |         self.networkMode = args[3].lower()
 24 |         self.fwdMode = args[4]
 25 |     def parseConfigFile(self):
 26 |         with open(self.cfgFile) as inFd:
 27 |             config = yaml.load(inFd)
 28 |         self.configInfo = SafeDict(config)
 29 | 
 30 |     def handleMissing(self, item, holder, fd):
 31 |         print "ERROR No entry for {} in {}".format(item, holder)
 32 |         fd.close()
 33 |         sys.exit(1)
 34 | 
 35 |     def writeInventoryEntry(self, outFd, config):
 36 |         if self.configInfo[config] is 'missing':
 37 |             self.handleMissing(config, self.cfgFile, outFd);
 38 |         else:
 39 |             cfg_entry = "{}={}\n".format(config.lower(), self.configInfo[config])
 40 |             outFd.write(cfg_entry)
 41 | 
 42 |     def writeInventory(self, outFd, groupName, groupRole):
 43 |         outFd.write("[" + groupName + "]\n")
 44 |         connInfo = SafeDict(self.configInfo['CONNECTION_INFO'])
 45 | 
 46 |         # Add host entries in the inventory file
 47 |         for node in connInfo:
 48 |             role = connInfo[node].get('role', 'worker')
 49 |             if role != groupRole:
 50 |                 continue
 51 |             var_line = "node{} ".format(self.nodeCount)
 52 |             outFd.write(var_line)
 53 |             var_line = "ansible_ssh_host={} ".format(node)
 54 |             outFd.write(var_line)
 55 |             var_line = "control_interface={} ".format(connInfo[node]['control'])
 56 |             outFd.write(var_line)
 57 |             var_line = "netplugin_if={} \n".format(connInfo[node]['data'])
 58 |             outFd.write(var_line)
 59 | 
 60 |             self.nodeCount += 1
 61 | 
 62 |         outFd.write("\n")
 63 | 
 64 |     def writeGlobalVars(self, outFd):
 65 |         outFd.write("[" + "all:vars]\n")
 66 |         var_line = "fwd_mode={}\n".format(self.fwdMode)
 67 |         net_mode = "vlan" if self.fwdMode == "bridge" else "vxlan"
 68 |         var_line += "net_mode=%s\n" % net_mode
 69 |         outFd.write(var_line)
 70 |         var_line = "contiv_network_mode={}\n".format(self.networkMode)
 71 |         outFd.write(var_line)
 72 | 
 73 |         # write group vars if network mode is ACI
 74 |         if self.networkMode == NW_MODE_ACI:
 75 |             self.writeInventoryEntry(outFd, 'APIC_URL')
 76 |             self.writeInventoryEntry(outFd, 'APIC_USERNAME')
 77 |             self.writeInventoryEntry(outFd, 'APIC_PASSWORD')
 78 |             self.writeInventoryEntry(outFd, 'APIC_PHYS_DOMAIN')
 79 |             self.writeInventoryEntry(outFd, 'APIC_EPG_BRIDGE_DOMAIN')
 80 |             self.writeInventoryEntry(outFd, 'APIC_CONTRACTS_UNRESTRICTED_MODE')
 81 | 
 82 |             if self.configInfo['APIC_LEAF_NODES'] is 'missing':
 83 |                 self.handleMissing("APIC_LEAF_NODES", self.cfgFile, outFd);
 84 | 
 85 |             if self.configInfo['APIC_LEAF_NODES'] is None:
 86 |                 self.handleMissing("APIC_LEAF_NODES", self.cfgFile, outFd);
 87 |             else:
 88 |                 leafCount = 0
 89 |                 leafStr = "apic_leaf_nodes="
 90 |                 for leaf in self.configInfo['APIC_LEAF_NODES']:
 91 |                     if leafCount > 0:
 92 |                         leafStr += ","
 93 | 
 94 |                     leafStr += leaf
 95 |                     leafCount += 1
 96 | 
 97 |                 # if no leaf was found, treat as error
 98 |                 if leafCount == 0:
 99 |                     self.handleMissing("APIC_LEAF_NODES", self.cfgFile, outFd);
100 | 
101 |                 leafStr += "\n"
102 |                 outFd.write(leafStr)
103 | 
104 |     def writeNodeInfo(self):
105 |         with open(self.nodeInfoFile, "w+") as nodeInfoFd:
106 |             # Node count starts from 1 and is incremented for
107 |             # each node. So the actual number of nodes is nodeCount -1
108 |             node_info = "{}".format(self.nodeCount - 1)
109 |             nodeInfoFd.write(node_info)
110 | 
111 |     def writeInventoryFile(self):
112 |         with open(self.inventoryFile, "w+") as outFd:
113 |             self.nodeCount = 1
114 |             self.writeInventory(outFd, Inventory.masterGroupName, "master")
115 |             self.writeInventory(outFd, Inventory.workerGroupName, "worker")
116 |             # The main group containing both the master and worker nodes
117 |             outFd.write("[" + Inventory.groupName + ":children]\n")
118 |             outFd.write(Inventory.masterGroupName + "\n")
119 |             outFd.write(Inventory.workerGroupName + "\n\n")
120 |             self.writeGlobalVars(outFd)
121 | 
122 | if __name__ == "__main__":
123 |     inv = Inventory(sys.argv[1:])
124 | 
125 |     inv.parseConfigFile()
126 | 
127 |     inv.writeInventoryFile()
128 | 
129 |     inv.writeNodeInfo()
130 | 


--------------------------------------------------------------------------------
/install/k8s/configs/aci_gw.yaml:
--------------------------------------------------------------------------------
 1 | 
 2 | # This manifest installs contiv-aci-gw container on
 3 | # each master and worker node in a Kubernetes cluster.
 4 | kind: DaemonSet
 5 | apiVersion: extensions/v1beta1
 6 | metadata:
 7 |   name: contiv-aci-gw
 8 |   namespace: kube-system
 9 |   labels:
10 |     k8s-app: contiv-aci-gw
11 | spec:
12 |   selector:
13 |     matchLabels:
14 |       k8s-app: contiv-aci-gw
15 |   template:
16 |     metadata:
17 |       labels:
18 |         k8s-app: contiv-aci-gw
19 |       annotations:
20 |         scheduler.alpha.kubernetes.io/critical-pod: ''
21 |     spec:
22 |       hostNetwork: true
23 |       tolerations:
24 |       - key: node-role.kubernetes.io/master
25 |         effect: NoSchedule
26 |       nodeSelector:
27 |         node-role.kubernetes.io/master: ""
28 |       serviceAccountName: contiv-netmaster
29 |       containers:
30 |         # Runs aci-gw container on each Kubernetes node. 
31 |         - name: contiv-aci-gw
32 |           image: contiv/aci-gw:__ACI_GW_VERSION__
33 |           env:
34 |             - name: APIC_URL
35 |               value: "__APIC_URL__"
36 |             - name: APIC_USERNAME
37 |               value: "__APIC_USERNAME__"
38 |             - name: APIC_PASSWORD
39 |               value: "__APIC_PASSWORD__"
40 |             - name: APIC_CERT_DN
41 |               value: "__APIC_CERT_DN__"
42 |             - name: APIC_LEAF_NODE
43 |               value: "__APIC_LEAF_NODE__"
44 |             - name: APIC_PHYS_DOMAIN
45 |               value: "__APIC_PHYS_DOMAIN__"
46 |             - name: APIC_EPG_BRIDGE_DOMAIN
47 |               value: "__APIC_EPG_BRIDGE_DOMAIN__"
48 |             - name: APIC_CONTRACTS_UNRESTRICTED_MODE
49 |               value: "__APIC_CONTRACTS_UNRESTRICTED_MODE__"
50 |           securityContext:
51 |             privileged: false
52 |           volumeMounts:
53 |             - mountPath: /aciconfig
54 |               name: aci-config
55 |       volumes:
56 |         - name: aci-config
57 |           secret:
58 |             secretName: aci.key
59 | 
60 | ---
61 | 
62 | 


--------------------------------------------------------------------------------
/install/k8s/configs/cleanup.yaml:
--------------------------------------------------------------------------------
 1 | 
 2 | # This manifest runs the contiv-cleanup container
 3 | kind: DaemonSet
 4 | apiVersion: extensions/v1beta1
 5 | metadata:
 6 |   name: contiv-cleanup
 7 |   namespace: kube-system
 8 |   labels:
 9 |     k8s-app: contiv-cleanup
10 | spec:
11 |   selector:
12 |     matchLabels:
13 |       k8s-app: contiv-cleanup
14 |   template:
15 |     metadata:
16 |       labels:
17 |         k8s-app: contiv-cleanup
18 |     spec:
19 |       hostNetwork: true
20 |       hostPID: true
21 |       containers:
22 |         # Runs netplugin cleanup container on each Kubernetes node.
23 |         - name: contiv-cleanup
24 |           image: contiv/netplugin:__CONTIV_VERSION__
25 |           args:
26 |             - -pkubernetes
27 |             - -r
28 |           securityContext:
29 |             privileged: true
30 |           volumeMounts:
31 |             - mountPath: /etc/openvswitch
32 |               name: etc-openvswitch
33 |               readOnly: false
34 |             - mountPath: /var/run
35 |               name: var-run
36 |               readOnly: false
37 |             - mountPath: /var/contiv
38 |               name: var-contiv
39 |               readOnly: false
40 |             - mountPath: /opt/cni/bin
41 |               name: cni-bin-dir
42 |               readOnly: false
43 |             - mountPath: /etc/cni/net.d/
44 |               name: etc-cni-dir
45 |               readOnly: false
46 |       volumes:
47 |         # Used by contiv-cleanup
48 |         - name: etc-openvswitch
49 |           hostPath:
50 |             path: /etc/openvswitch
51 |         - name: var-run
52 |           hostPath:
53 |             path: /var/run
54 |         - name: var-contiv
55 |           hostPath:
56 |             path: /var/contiv
57 |         - name: cni-bin-dir
58 |           hostPath:
59 |             path: /opt/cni/bin
60 |         - name: etc-cni-dir
61 |           hostPath:
62 |             path: /etc/cni/net.d/
63 | ---
64 | 
65 | 


--------------------------------------------------------------------------------
/install/k8s/configs/contiv-grafana.yml:
--------------------------------------------------------------------------------
 1 | # Grafana is a process and hence needs service account access
 2 | ---
 3 | apiVersion: v1
 4 | kind: ServiceAccount
 5 | metadata:
 6 |   name: grafana
 7 |   namespace: kube-system
 8 | # Deploy Grafana as a replicaset with one container
 9 | ---
10 | apiVersion: extensions/v1beta1
11 | kind: ReplicaSet
12 | metadata:
13 |   name: contiv-grafana
14 |   namespace: kube-system
15 |   labels:
16 |     k8s-app: contiv-grafana
17 | spec:
18 |   replicas: 1
19 |   template:
20 |     metadata:
21 |       name: contiv-grafana
22 |       labels:
23 |         k8s-app: contiv-grafana
24 |       annotations:
25 |         scheduler.alpha.kubernetes.io/critical-pod: ''
26 |     spec:
27 |       tolerations:
28 |       - key: node-role.kubernetes.io/master
29 |         effect: NoSchedule
30 |       nodeSelector:
31 |         node-role.kubernetes.io/master: ""
32 |       containers:
33 |         - name: contiv-grafana
34 |           image: grafana/grafana
35 |       serviceAccountName: grafana
36 | # Expose Grafana as a service
37 | ---
38 | apiVersion: v1
39 | kind: Service
40 | metadata:
41 |   name: grafana
42 |   namespace: kube-system
43 | spec:
44 |   type: NodePort 
45 |   selector:
46 |     k8s-app: contiv-grafana
47 |   ports:
48 |     - protocol: TCP
49 |       port: 3000
50 |       nodePort: 32701
51 |       
52 | 


--------------------------------------------------------------------------------
/install/k8s/configs/contiv-prometheus.yml:
--------------------------------------------------------------------------------
 1 | # Gives Prometheus permission to share the cluster
 2 | apiVersion: rbac.authorization.k8s.io/v1beta1
 3 | kind: ClusterRole
 4 | metadata:
 5 |   name: prometheus
 6 |   namespace: kube-system
 7 | rules:
 8 | - apiGroups: [""]
 9 |   resources:
10 |   - pods
11 |   verbs: ["get", "list", "watch"]
12 | - nonResourceURLs: ["/metrics"]
13 |   verbs: ["get"]
14 | ---
15 | # Prometheus is a process and hence needs service account access
16 | apiVersion: v1
17 | kind: ServiceAccount
18 | metadata:
19 |   name: prometheus
20 |   namespace: kube-system
21 | # Binds Prometheus to the kube-system namespace
22 | ---
23 | apiVersion: rbac.authorization.k8s.io/v1beta1
24 | kind: ClusterRoleBinding
25 | metadata:
26 |   name: prometheus
27 |   namespace: kube-system
28 | roleRef:
29 |   apiGroup: rbac.authorization.k8s.io
30 |   kind: ClusterRole
31 |   name: prometheus
32 | subjects:
33 | - kind: ServiceAccount
34 |   name: prometheus
35 |   namespace: kube-system
36 | # Deploy prometheus as a replicaset with one container
37 | ---
38 | apiVersion: extensions/v1beta1
39 | kind: ReplicaSet
40 | metadata:
41 |   name: contiv-prometheus
42 |   namespace: kube-system
43 |   labels:
44 |     k8s-app: contiv-prometheus
45 | spec:
46 |   replicas: 1
47 |   template:
48 |     metadata:
49 |       name: contiv-prometheus
50 |       labels:
51 |         k8s-app: contiv-prometheus
52 |       annotations:
53 |         scheduler.alpha.kubernetes.io/critical-pod: ''
54 |     spec:
55 |       tolerations:
56 |       - key: node-role.kubernetes.io/master
57 |         effect: NoSchedule
58 |       nodeSelector:
59 |         node-role.kubernetes.io/master: ""
60 |       containers:
61 |         - name: contiv-prometheus
62 |           image: prom/prometheus
63 |           volumeMounts:
64 |             - mountPath: /etc/prometheus
65 |               name: var-contiv
66 |       volumes:
67 |         - name: var-contiv
68 |           hostPath:
69 |             path: /var/contiv
70 |       serviceAccountName: prometheus
71 | # Expose prometheus as a service
72 | ---
73 | apiVersion: v1
74 | kind: Service
75 | metadata:
76 |   name: prometheus
77 |   namespace: kube-system
78 | spec:
79 |   type: NodePort 
80 |   selector:
81 |     k8s-app: contiv-prometheus 
82 |   ports:
83 |     - protocol: TCP
84 |       port: 9090
85 |       nodePort: 32700
86 | 
87 | 


--------------------------------------------------------------------------------
/install/k8s/configs/contiv.yaml:
--------------------------------------------------------------------------------
  1 | ---
  2 | apiVersion: rbac.authorization.k8s.io/v1beta1
  3 | kind: ClusterRoleBinding
  4 | metadata:
  5 |   name: contiv-netplugin
  6 | roleRef:
  7 |   apiGroup: rbac.authorization.k8s.io
  8 |   kind: ClusterRole
  9 |   name: contiv-netplugin
 10 | subjects:
 11 | - kind: ServiceAccount
 12 |   name: contiv-netplugin
 13 |   namespace: kube-system
 14 | 
 15 | ---
 16 | 
 17 | kind: ClusterRole
 18 | apiVersion: rbac.authorization.k8s.io/v1beta1
 19 | metadata:
 20 |   name: contiv-netplugin
 21 |   namespace: kube-system
 22 | rules:
 23 |   - apiGroups:
 24 |     - ""
 25 |     - extensions
 26 |     resources:
 27 |       - endpoints
 28 |       - nodes
 29 |       - namespaces
 30 |       - networkpolicies
 31 |       - pods
 32 |       - services
 33 |     verbs:
 34 |       - watch
 35 |       - list
 36 |       - update
 37 |       - get
 38 | 
 39 | ---
 40 | 
 41 | apiVersion: v1
 42 | kind: ServiceAccount
 43 | metadata:
 44 |   name: contiv-netplugin
 45 |   namespace: kube-system
 46 |   labels:
 47 |     kubernetes.io/cluster-service: "true"
 48 | 
 49 | ---
 50 | 
 51 | apiVersion: rbac.authorization.k8s.io/v1beta1
 52 | kind: ClusterRoleBinding
 53 | metadata:
 54 |   name: contiv-netmaster
 55 | roleRef:
 56 |   apiGroup: rbac.authorization.k8s.io
 57 |   kind: ClusterRole
 58 |   name: contiv-netmaster
 59 | subjects:
 60 | - kind: ServiceAccount
 61 |   name: contiv-netmaster
 62 |   namespace: kube-system
 63 | 
 64 | ---
 65 | 
 66 | kind: ClusterRole
 67 | apiVersion: rbac.authorization.k8s.io/v1beta1
 68 | metadata:
 69 |   name: contiv-netmaster
 70 |   namespace: kube-system
 71 | rules:
 72 |   - apiGroups:
 73 |     - ""
 74 |     - extensions
 75 |     resources:
 76 |       - pods
 77 |       - nodes
 78 |       - namespaces
 79 |       - networkpolicies
 80 |     verbs:
 81 |       - watch
 82 |       - list
 83 |       - update
 84 | 
 85 | ---
 86 | 
 87 | apiVersion: v1
 88 | kind: ServiceAccount
 89 | metadata:
 90 |   name: contiv-netmaster
 91 |   namespace: kube-system
 92 |   labels:
 93 |     kubernetes.io/cluster-service: "true"
 94 | 
 95 | ---
 96 | 
 97 | # This ConfigMap is used to configure a self-hosted Contiv installation.
 98 | # It can be used with an external cluster store(etcd or consul) or used
 99 | # with the etcd instance being installed as contiv-etcd
100 | kind: ConfigMap
101 | apiVersion: v1
102 | metadata:
103 |   name: contiv-config
104 |   namespace: kube-system
105 | data:
106 |   contiv_mode: kubernetes
107 |   contiv_fwdmode: routing
108 |   contiv_netmode: vxlan
109 |   # The location of your cluster store. This is set to the
110 |   # avdertise-client value below from the contiv-etcd service.
111 |   # Change it to an external etcd/consul instance if required.
112 |   contiv_etcd: "http://__NETMASTER_IP__:6666"
113 |   # The CNI network configuration to install on each node.
114 |   contiv_cni_config: |-
115 |     {
116 |       "cniVersion": "0.6.0",
117 |       "name": "contiv-net",
118 |       "type": "contivk8s"
119 |     }
120 |   contiv_k8s_config: |-
121 |     {
122 |        "K8S_API_SERVER": "https://__NETMASTER_IP__:6443",
123 |        "K8S_CA": "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt",
124 |        "K8S_KEY": "",
125 |        "K8S_CERT": "",
126 |        "K8S_TOKEN": "",
127 |        "SVC_SUBNET": "10.96.0.0/12"
128 |     }
129 | 
130 | ---
131 | 
132 | # This manifest installs contiv-netplugin container, as well
133 | # as the Contiv CNI plugins and network config on
134 | # each master and worker node in a Kubernetes cluster.
135 | kind: DaemonSet
136 | apiVersion: extensions/v1beta1
137 | metadata:
138 |   name: contiv-netplugin
139 |   namespace: kube-system
140 |   labels:
141 |     k8s-app: contiv-netplugin
142 | spec:
143 |   selector:
144 |     matchLabels:
145 |       k8s-app: contiv-netplugin
146 |   template:
147 |     metadata:
148 |       labels:
149 |         k8s-app: contiv-netplugin
150 |       annotations:
151 |         prometheus.io/scrape: 'true'
152 |         prometheus.io/port: '9004'
153 |         scheduler.alpha.kubernetes.io/critical-pod: ''
154 |     spec:
155 |       hostNetwork: true
156 |       hostPID: true
157 |       tolerations:
158 |       - key: node-role.kubernetes.io/master
159 |         effect: NoSchedule
160 |       serviceAccountName: contiv-netplugin
161 |       containers:
162 |         - name: netplugin-exporter
163 |           image: contiv/stats
164 |           env:
165 |             - name: CONTIV_ETCD
166 |               valueFrom:
167 |                 configMapKeyRef:
168 |                   name: contiv-config
169 |                   key: contiv_etcd
170 |             - name: EXPORTER_MODE
171 |               value: 'netplugin'
172 |         - name: contiv-netplugin
173 |           image: contiv/netplugin:__CONTIV_VERSION__
174 |           env:
175 |             - name: CONTIV_ROLE
176 |               value: netplugin
177 |             - name: CONTIV_NETPLUGIN_MODE
178 |               valueFrom:
179 |                 configMapKeyRef:
180 |                   name: contiv-config
181 |                   key: contiv_mode
182 |             - name: CONTIV_NETPLUGIN_VTEP_IP
183 |               valueFrom:
184 |                  fieldRef:
185 |                     fieldPath: status.podIP
186 |             - name: CONTIV_NETPLUGIN_ETCD_ENDPOINTS
187 |               valueFrom:
188 |                 configMapKeyRef:
189 |                   name: contiv-config
190 |                   key: contiv_etcd
191 |             - name: CONTIV_CNI_CONFIG
192 |               valueFrom:
193 |                 configMapKeyRef:
194 |                   name: contiv-config
195 |                   key: contiv_cni_config
196 |             - name: CONTIV_K8S_CONFIG
197 |               valueFrom:
198 |                 configMapKeyRef:
199 |                   name: contiv-config
200 |                   key: contiv_k8s_config
201 |             - name: CONTIV_NETPLUGIN_FORWARD_MODE
202 |               valueFrom:
203 |                 configMapKeyRef:
204 |                   name: contiv-config
205 |                   key: contiv_fwdmode
206 |             - name: CONTIV_NETPLUGIN_NET_MODE
207 |               valueFrom:
208 |                 configMapKeyRef:
209 |                   name: contiv-config
210 |                   key: contiv_netmode
211 |           securityContext:
212 |             privileged: true
213 |           volumeMounts:
214 |             - mountPath: /etc/openvswitch
215 |               name: etc-openvswitch
216 |               readOnly: false
217 |             - mountPath: /lib/modules
218 |               name: lib-modules
219 |               readOnly: false
220 |             - mountPath: /var/run
221 |               name: var-run
222 |               readOnly: false
223 |             - mountPath: /var/contiv
224 |               name: var-contiv
225 |               readOnly: false
226 |             - mountPath: /var/log/contiv
227 |               name: var-log-contiv
228 |               readOnly: false
229 |             - mountPath: /opt/cni/bin
230 |               name: cni-bin-dir
231 |               readOnly: false
232 |             - mountPath: /etc/cni/net.d/
233 |               name: etc-cni-dir
234 |               readOnly: false
235 |       volumes:
236 |         # Used by contiv-netplugin
237 |         - name: etc-openvswitch
238 |           hostPath:
239 |             path: /etc/openvswitch
240 |         - name: lib-modules
241 |           hostPath:
242 |             path: /lib/modules
243 |         - name: var-run
244 |           hostPath:
245 |             path: /var/run
246 |         - name: var-contiv
247 |           hostPath:
248 |             path: /var/contiv
249 |         - name: cni-bin-dir
250 |           hostPath:
251 |             path: /opt/cni/bin
252 |         - name: etc-cni-dir
253 |           hostPath:
254 |             path: /etc/cni/net.d/
255 |         - name: var-log-contiv
256 |           hostPath:
257 |             path: /var/log/contiv
258 | ---
259 | 
260 | # This manifest deploys the Contiv API Server on Kubernetes.
261 | apiVersion: extensions/v1beta1
262 | kind: ReplicaSet
263 | metadata:
264 |   name: contiv-netmaster
265 |   namespace: kube-system
266 |   labels:
267 |     k8s-app: contiv-netmaster
268 | spec:
269 |   # The netmaster should have 1, 3, 5 nodes of which one is active at any given time.
270 |   # More nodes are desired in a production environment for HA.
271 |   replicas: 1
272 |   template:
273 |     metadata:
274 |       name: contiv-netmaster
275 |       namespace: kube-system
276 |       labels:
277 |         k8s-app: contiv-netmaster
278 |       annotations:
279 |         prometheus.io/scrape: 'true'
280 |         prometheus.io/port: '9005'
281 |         scheduler.alpha.kubernetes.io/critical-pod: ''
282 |     spec:
283 |       # The netmaster must run in the host network namespace so that
284 |       # it isn't governed by policy that would prevent it from working.
285 |       hostNetwork: true
286 |       tolerations:
287 |       - key: node-role.kubernetes.io/master
288 |         effect: NoSchedule
289 |       nodeSelector:
290 |         node-role.kubernetes.io/master: ""
291 |       serviceAccountName: contiv-netmaster
292 |       containers:
293 |         - name: netmaster-exporter
294 |           image: contiv/stats
295 |           env:
296 |             - name: CONTIV_ETCD
297 |               valueFrom:
298 |                 configMapKeyRef:
299 |                   name: contiv-config
300 |                   key: contiv_etcd
301 |             - name: EXPORTER_MODE
302 |               value: 'netmaster'
303 |         - name: contiv-netmaster
304 |           image: contiv/netplugin:__CONTIV_VERSION__
305 |           env:
306 |             - name: CONTIV_ROLE
307 |               value: netmaster
308 |             - name: CONTIV_NETMASTER_MODE
309 |               valueFrom:
310 |                 configMapKeyRef:
311 |                   name: contiv-config
312 |                   key: contiv_mode
313 |             - name: CONTIV_NETMASTER_ETCD_ENDPOINTS
314 |               valueFrom:
315 |                 configMapKeyRef:
316 |                   name: contiv-config
317 |                   key: contiv_etcd
318 |             - name: CONTIV_K8S_CONFIG
319 |               valueFrom:
320 |                 configMapKeyRef:
321 |                   name: contiv-config
322 |                   key: contiv_k8s_config
323 |             - name: CONTIV_NETMASTER_FORWARD_MODE
324 |               valueFrom:
325 |                 configMapKeyRef:
326 |                   name: contiv-config
327 |                   key: contiv_fwdmode
328 |             - name: CONTIV_NETMASTER_NET_MODE
329 |               valueFrom:
330 |                 configMapKeyRef:
331 |                   name: contiv-config
332 |                   key: contiv_netmode
333 |           volumeMounts:
334 |             - mountPath: /var/contiv
335 |               name: var-contiv
336 |               readOnly: false
337 |             - mountPath: /var/log/contiv
338 |               name: var-log-contiv
339 |               readOnly: false
340 | 
341 |         - name: contiv-api-proxy
342 |           image: contiv/auth_proxy:__API_PROXY_VERSION__
343 |           args:
344 |             - --tls-key-file=/var/contiv/auth_proxy_key.pem
345 |             - --tls-certificate=/var/contiv/auth_proxy_cert.pem
346 |             - --data-store-address=$(STORE_URL)
347 |             - --data-store-driver=$(STORE_DRIVER)
348 |             - --netmaster-address=localhost:9999
349 |           env:
350 |             - name: NO_NETMASTER_STARTUP_CHECK
351 |               value: "0"
352 |             - name: STORE_URL
353 |               valueFrom:
354 |                 configMapKeyRef:
355 |                   name: contiv-config
356 |                   key: contiv_etcd
357 |             - name: STORE_DRIVER
358 |               value: etcd
359 |           securityContext:
360 |             privileged: false
361 |           volumeMounts:
362 |             - mountPath: /var/contiv
363 |               name: var-contiv
364 |               readOnly: false
365 |       volumes:
366 |         # Used by contiv-netmaster
367 |         - name: var-contiv
368 |           hostPath:
369 |             path: /var/contiv
370 |         - name: var-log-contiv
371 |           hostPath:
372 |             path: /var/log/contiv
373 | 


--------------------------------------------------------------------------------
/install/k8s/configs/etcd.yaml:
--------------------------------------------------------------------------------
  1 | ---
  2 | kind: DaemonSet
  3 | apiVersion: extensions/v1beta1
  4 | metadata:
  5 |   name: contiv-etcd
  6 |   namespace: kube-system
  7 |   labels:
  8 |     k8s-app: contiv-etcd
  9 | spec:
 10 |   selector:
 11 |     matchLabels:
 12 |       k8s-app: contiv-etcd
 13 |   template:
 14 |     metadata:
 15 |       labels:
 16 |         k8s-app: contiv-etcd
 17 |       annotations:
 18 |         scheduler.alpha.kubernetes.io/critical-pod: ''
 19 |     spec:
 20 |       hostNetwork: true
 21 |       hostPID: true
 22 |       nodeSelector:
 23 |         node-role.kubernetes.io/master: ''
 24 |       tolerations:
 25 |         - key: node-role.kubernetes.io/master
 26 |           effect: NoSchedule
 27 |       initContainers:
 28 |         - name: contiv-etcd-init
 29 |           image: ferest/etcd-initer:latest
 30 |           imagePullPolicy: Always
 31 |           env:
 32 |             - name: ETCD_INIT_ARGSFILE
 33 |               value: /etc/contiv/etcd/contiv-etcd-args
 34 |             - name: ETCD_INIT_LISTEN_PORT
 35 |               value: '6666'
 36 |             - name: ETCD_INIT_PEER_PORT
 37 |               value: '6667'
 38 |             - name: ETCD_INIT_CLUSTER
 39 |               value: 'contiv0=http://__NETMASTER_IP__:6667'
 40 |             - name: ETCD_INIT_DATA_DIR
 41 |               value: /var/lib/etcd/contiv-data
 42 |           volumeMounts:
 43 |             - name: contiv-etcd-conf-dir
 44 |               mountPath: /etc/contiv/etcd
 45 |       containers:
 46 |         - name: contiv-etcd
 47 |           image: quay.io/coreos/etcd:__ETCD_VERSION__
 48 |           command:
 49 |             - sh
 50 |             - -c
 51 |             - "/usr/local/bin/etcd $(cat $ETCD_INIT_ARGSFILE)"
 52 |           env:
 53 |             - name: ETCD_INIT_ARGSFILE
 54 |               value: /etc/contiv/etcd/contiv-etcd-args
 55 |           volumeMounts:
 56 |             - name: contiv-etcd-conf-dir
 57 |               mountPath: /etc/contiv/etcd
 58 |             - name: contiv-etcd-data-dir
 59 |               mountPath: /var/lib/etcd/contiv-data
 60 |       volumes:
 61 |         - name: contiv-etcd-data-dir
 62 |           hostPath:
 63 |             path: /var/lib/etcd/contiv-data
 64 |         - name: contiv-etcd-conf-dir
 65 |           hostPath:
 66 |             path: /etc/contiv/etcd
 67 | 
 68 | ---
 69 | 
 70 | kind: DaemonSet
 71 | apiVersion: extensions/v1beta1
 72 | metadata:
 73 |   name: contiv-etcd-proxy
 74 |   namespace: kube-system
 75 |   labels:
 76 |     k8s-app: contiv-etcd-proxy
 77 | spec:
 78 |   selector:
 79 |     matchLabels:
 80 |       k8s-app: contiv-etcd-proxy
 81 |   template:
 82 |     metadata:
 83 |       labels:
 84 |         k8s-app: contiv-etcd-proxy
 85 |       annotations:
 86 |         scheduler.alpha.kubernetes.io/critical-pod: ''
 87 |     spec:
 88 |       hostNetwork: true
 89 |       hostPID: true
 90 |       containers:
 91 |         - name: contiv-etcd-proxy
 92 |           image: quay.io/coreos/etcd:__ETCD_VERSION__
 93 |           env:
 94 |             - name: ETCD_LISTEN_CLIENT_URLS
 95 |               value: 'http://127.0.0.1:6666'
 96 |             - name: ETCD_PROXY
 97 |               value: "on"
 98 |             - name: ETCD_INITIAL_CLUSTER
 99 |               value: 'contiv0=http://__NETMASTER_IP__:6667'
100 | 


--------------------------------------------------------------------------------
/install/k8s/configs/prometheus.yml:
--------------------------------------------------------------------------------
 1 | # Prometheus configuration to scrape all netplugin endpoints every 5 seconds
 2 | scrape_configs:
 3 | - job_name: 'kubernetes-pods'
 4 |   scrape_interval: 5s
 5 |   scrape_timeout: 5s
 6 | 
 7 |   kubernetes_sd_configs:
 8 |   - role: pod
 9 | 
10 |   relabel_configs:
11 |   - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
12 |     action: keep
13 |     regex: true
14 |   - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
15 |     action: replace
16 |     target_label: __metrics_path__
17 |     regex: (.+)
18 |   - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
19 |     action: replace
20 |     regex: ([^:]+)(?::\d+)?;(\d+)
21 |     replacement: $1:$2
22 |     target_label: __address__
23 |   - action: labelmap
24 |     regex: __meta_kubernetes_pod_label_(.+)
25 |   - source_labels: [__meta_kubernetes_namespace]
26 |     action: replace
27 |     target_label: kubernetes_namespace
28 |   - source_labels: [__meta_kubernetes_pod_name]
29 |     action: replace
30 |     target_label: kubernetes_pod_name
31 | 


--------------------------------------------------------------------------------
/install/k8s/install.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | # This is the install script for Contiv.
  3 | 
  4 | set -euo pipefail
  5 | 
  6 | if [ $EUID -ne 0 ]; then
  7 | 	echo "Please run this script as root user"
  8 | 	exit 1
  9 | fi
 10 | 
 11 | if [ -e /etc/kubernetes/admin.conf ]; then
 12 | 	kubectl="kubectl --kubeconfig /etc/kubernetes/admin.conf"
 13 | else
 14 | 	kubectl="kubectl"
 15 | fi
 16 | 
 17 | #
 18 | # The following parameters are user defined - and vary for each installation
 19 | #
 20 | 
 21 | # If an etcd or consul cluster store is not provided, we will start an etcd instance
 22 | cluster_store_urls=""
 23 | 
 24 | # Netmaster address
 25 | netmaster=""
 26 | 
 27 | # Dataplane interface
 28 | vlan_if=""
 29 | 
 30 | # Specify TLS certs to be used for API server
 31 | tls_cert=""
 32 | tls_key=""
 33 | fwd_mode="routing"
 34 | # ACI parameters
 35 | apic_url=""
 36 | apic_username=""
 37 | apic_password=""
 38 | apic_leaf_node=""
 39 | apic_phys_domain=""
 40 | apic_epg_bridge_domain="not_specified"
 41 | apic_contracts_unrestricted_mode="no"
 42 | aci_key=""
 43 | apic_cert_dn=""
 44 | 
 45 | infra_gateway="132.1.1.1"
 46 | infra_subnet="132.1.1.0/24"
 47 | 
 48 | usage() {
 49 | 	echo "Usage:"
 50 | 	cat <<EOF
 51 | Contiv Installer for Kubeadm based setups.
 52 | 
 53 | Installer:
 54 | Usage: ./install/k8s/install.sh OPTIONS
 55 | 
 56 | Mandatory Options:
 57 | -n   string     DNS name/IP address of the host to be used as the net master service VIP.
 58 | 
 59 | Additional Options:
 60 | 
 61 | -e   string     external etcd endpoints for cluster store
 62 | -c   string     external consul endpoints for cluster store
 63 | -s   string     (DEPRECATED) External cluster store to be used to store contiv data. This can be an etcd or consul server.
 64 | -v   string     Data plane interface
 65 | -w   string     Forwarding mode (“routing” or “bridge”). Default mode is “bridge”
 66 | -t   string     Certificate to use for auth proxy https endpoint
 67 | -k   string     Key to use for auth proxy https endpoint
 68 | -g   string     Gateway to use for the infrastructure network
 69 | -i   string     The subnet to use for the infrastructure network
 70 | 
 71 | Additional Options for ACI:
 72 | -a   string     APIC URL to use for ACI mode
 73 | -u   string     Username to connect to the APIC
 74 | -p   string     Password to connect to the APIC
 75 | -l   string     APIC leaf node
 76 | -d   string     APIC physical domain
 77 | -b   string     APIC EPG bridge domain
 78 | -m   string     APIC contracts unrestricted mode
 79 | 
 80 | Examples:
 81 | 
 82 | 1. Install Contiv on Kubeadm master host using the specified DNS/IP for netmaster.
 83 | ./install/k8s/install.sh -n <netmaster DNS/IP>
 84 | 
 85 | 2. Install Contiv on Kubeadm master host using the specified DNS/IP for netmaster and specified ACI configuration.
 86 | ./install/k8s/install.sh -n <netmaster DNS/IP> -a https://apic_host:443 -u apic_user -p apic_password -l topology/pod-xxx/node-xxx -d phys_domain -e not_specified -m no
 87 | 
 88 | Advanced Usage:
 89 | 
 90 | This installer creates a Kubernetes application specification in a file named .contiv.yaml.
 91 | For further customization, you can edit this file manually and run the following to re-install Contiv.
 92 | 
 93 | $kubectl delete -f .contiv.yaml
 94 | $kubectl apply -f .contiv.yaml (This .contiv.yaml contains the new changes.)
 95 | 
 96 | EOF
 97 | 	exit 1
 98 | }
 99 | 
100 | # this function copies $1 to $2 if the full paths to $1 and $2 (as determined by
101 | # `realpath`) are different.  this allows people to specify a certificate, key, etc.
102 | # which was moved into place by a previous installer run.
103 | function copy_unless_identical_paths() {
104 | 	local src="$(realpath "$1")"
105 | 	local dest="$(realpath "$2")"
106 | 
107 | 	if [ "$src" != "$dest" ]; then
108 | 		cp -u "$src" "$dest"
109 | 	fi
110 | }
111 | 
112 | error_ret() {
113 | 	echo ""
114 | 	echo "$*"
115 | 	exit 1
116 | }
117 | 
118 | while getopts ":c:e:s:n:v:w:t:k:a:u:p:l:d:b:m:y:z:g:i:" opt; do
119 | 	case $opt in
120 | 	e)
121 | 		# etcd endpoint option
122 | 		cluster_store_type=etcd
123 | 		cluster_store_urls=$OPTARG
124 | 		install_etcd=false
125 | 		;;
126 | 	c)
127 | 		# consul endpoint option
128 | 		cluster_store_type=consul
129 | 		cluster_store_urls=$OPTARG
130 | 		install_etcd=false
131 | 		;;
132 | 	s)
133 | 		# backward compatibility
134 | 		echo "-s option has been deprecated, use -e or -c instead"
135 | 		local cluster_store=$OPTARG
136 | 		if [[ "$cluster_store" =~ ^etcd://.+ ]]; then
137 | 			cluster_store_type=etcd
138 | 			cluster_store_urls=$(echo $cluster_store | sed s/etcd/http/)
139 | 		elif [[ "$cluster_store" =~ ^consul://.+ ]]; then
140 | 			cluster_store_type=consul
141 | 			cluster_store_urls=$(echo $cluster_store | sed s/consul/http/)
142 | 		fi
143 | 		;;
144 | 	n)
145 | 		netmaster=$OPTARG
146 | 		;;
147 | 	v)
148 | 		vlan_if=$OPTARG
149 | 		;;
150 | 	w)
151 | 		fwd_mode=$OPTARG
152 | 		;;
153 | 	t)
154 | 		tls_cert=$OPTARG
155 | 		;;
156 | 	k)
157 | 		tls_key=$OPTARG
158 | 		;;
159 | 	a)
160 | 		apic_url=$OPTARG
161 | 		;;
162 | 	u)
163 | 		apic_username=$OPTARG
164 | 		;;
165 | 	p)
166 | 		apic_password=$OPTARG
167 | 		;;
168 | 	l)
169 | 		apic_leaf_node=$OPTARG
170 | 		;;
171 | 	d)
172 | 		apic_phys_domain=$OPTARG
173 | 		;;
174 | 	b)
175 | 		apic_epg_bridge_domain=$OPTARG
176 | 		;;
177 | 	m)
178 | 		apic_contracts_unrestricted_mode=$OPTARG
179 | 		;;
180 | 	y)
181 | 		aci_key=$OPTARG
182 | 		;;
183 | 	z)
184 | 		apic_cert_dn=$OPTARG
185 | 		;;
186 | 	g)
187 | 		infra_gateway=$OPTARG
188 | 		;;
189 | 	i)
190 | 		infra_subnet=$OPTARG
191 | 		;;
192 | 	:)
193 | 		echo "An argument required for $OPTARG was not passed"
194 | 		usage
195 | 		;;
196 | 	?)
197 | 		usage
198 | 		;;
199 | 	esac
200 | done
201 | 
202 | if [ "$netmaster" = "" ]; then
203 | 	usage
204 | fi
205 | 
206 | if [[ "$apic_url" != "" && "$apic_password" == "" && "$aci_key" == "" ]]; then
207 | 	read -s -p "Enter the APIC password: ", apic_password
208 | 	if [ "$apic_password" = "" ]; then
209 | 		usage
210 | 	fi
211 | fi
212 | 
213 | if [[ "$apic_url" != "" ]]; then
214 | 	if [[ "$apic_username" == "" || "$apic_phys_domain" == "" || "$apic_leaf_node" == "" ]]; then
215 | 		usage
216 | 	fi
217 | fi
218 | 
219 | echo "Installing Contiv for Kubernetes"
220 | # Cleanup any older config files
221 | contiv_yaml="./.contiv.yaml"
222 | rm -f $contiv_yaml
223 | 
224 | # Create the new config file from the templates
225 | contiv_yaml_template="./install/k8s/configs/contiv.yaml"
226 | contiv_etcd_template="./install/k8s/configs/etcd.yaml"
227 | contiv_aci_gw_template="./install/k8s/configs/aci_gw.yaml"
228 | 
229 | cat $contiv_yaml_template >>$contiv_yaml
230 | 
231 | if [ "$cluster_store_urls" = "" ]; then
232 | 	cat $contiv_etcd_template >>$contiv_yaml
233 | elif [ "$cluster_store_type" = "etcd" ]; then
234 | 	sed -i.bak "s#contiv_etcd:.*#contiv_etcd: \"$cluster_store_urls\"#g" $contiv_yaml
235 | elif [ "$cluster_store_type" = "consul" ]; then
236 | 	sed -i.bak "s#contiv_etcd:.*#contiv_consul: \"$cluster_store_urls\"#g" $contiv_yaml
237 | 	# change auth_proxy
238 | 	sed -i.bak "s#value: etcd#value: consul#g" $contiv_yaml
239 | fi
240 | 
241 | if [ "$apic_url" != "" ]; then
242 | 	cat $contiv_aci_gw_template >>$contiv_yaml
243 | 	# We do not support routing in ACI mode
244 | 	fwd_mode="bridge"
245 | fi
246 | 
247 | # delete existing ACI key secret (if any)
248 | $kubectl get secret aci.key -n kube-system &>/dev/null && $kubectl delete secret aci.key -n kube-system
249 | 
250 | # We will store the ACI key in a k8s secret.
251 | # The name of the file should be aci.key
252 | if [ "$aci_key" = "" ]; then
253 | 	echo "dummy" >./aci.key
254 | else
255 | 	copy_unless_identical_paths $aci_key ./aci.key
256 | fi
257 | aci_key=./aci.key
258 | 
259 | $kubectl create secret generic aci.key --from-file=$aci_key -n kube-system
260 | 
261 | mkdir -p /var/contiv
262 | 
263 | if [ "$tls_cert" = "" ]; then
264 | 	echo "Generating local certs for Contiv Proxy"
265 | 	mkdir -p ./local_certs
266 | 
267 | 	chmod +x ./install/generate-certificate.sh
268 | 	./install/generate-certificate.sh
269 | 	tls_cert=./local_certs/cert.pem
270 | 	tls_key=./local_certs/local.key
271 | fi
272 | copy_unless_identical_paths $tls_cert /var/contiv/auth_proxy_cert.pem
273 | copy_unless_identical_paths $tls_key /var/contiv/auth_proxy_key.pem
274 | 
275 | echo "Setting installation parameters"
276 | sed -i.bak "s/__NETMASTER_IP__/$netmaster/g" $contiv_yaml
277 | sed -i.bak "s/__VLAN_IF__/$vlan_if/g" $contiv_yaml
278 | 
279 | if [ "$apic_url" != "" ]; then
280 | 	sed -i.bak "s#__APIC_URL__#$apic_url#g" $contiv_yaml
281 | 	sed -i.bak "s/__APIC_USERNAME__/$apic_username/g" $contiv_yaml
282 | 	sed -i.bak "s/__APIC_PASSWORD__/$apic_password/g" $contiv_yaml
283 | 	sed -i.bak "s#__APIC_LEAF_NODE__#$apic_leaf_node#g" $contiv_yaml
284 | 	sed -i.bak "s/__APIC_PHYS_DOMAIN__/$apic_phys_domain/g" $contiv_yaml
285 | 	sed -i.bak "s/__APIC_EPG_BRIDGE_DOMAIN__/$apic_epg_bridge_domain/g" $contiv_yaml
286 | 	sed -i.bak "s/__APIC_CONTRACTS_UNRESTRICTED_MODE__/$apic_contracts_unrestricted_mode/g" $contiv_yaml
287 | fi
288 | if [ "$apic_cert_dn" = "" ]; then
289 | 	sed -i.bak "/APIC_CERT_DN/d" $contiv_yaml
290 | else
291 | 	sed -i.bak "s#__APIC_CERT_DN__#$apic_cert_dn#g" $contiv_yaml
292 | fi
293 | 
294 | echo "Applying contiv installation"
295 | grep -q -F "netmaster" /etc/hosts || echo "$netmaster netmaster" >>/etc/hosts
296 | echo "To customize the installation press Ctrl+C and edit $contiv_yaml."
297 | sleep 5
298 | 
299 | # extract netctl from netplugin container
300 | echo "Extracting netctl from netplugin container"
301 | netplugin_version=$(
302 | 	sed '/contiv_network_version/!d;s/.*\: \?"\(.*\)".*/\1/' \
303 | 		install/ansible/env.json
304 | )
305 | docker rm netplugin-tmp >/dev/null 2>/dev/null || :
306 | c_id=$(docker create --name netplugin-tmp contiv/netplugin:$netplugin_version)
307 | docker cp ${c_id}:/contiv/bin/netctl /usr/bin
308 | docker rm ${c_id}
309 | 
310 | # Install Contiv
311 | $kubectl apply -f $contiv_yaml
312 | 
313 | set +e
314 | for i in {0..150}; do
315 | 	sleep 2
316 | 	# check contiv netmaster pods
317 | 	$kubectl get pods -n kube-system | grep -v "Running" | grep -q ^contiv-netmaster && continue
318 | 	# check that netmaster is available
319 | 	netctl tenant ls >/dev/null 2>&1 || continue
320 | 	break
321 | done
322 | 
323 | [[ $i -ge 150 ]] && error_ret "contiv netmaster is not ready !!"
324 | 
325 | set -e
326 | 
327 | # fwd mode has to be routing to make it work with vxlan
328 | netctl net ls -q | grep -q -w "contivh1" || netctl net create -n infra -s $infra_subnet -g $infra_gateway contivh1
329 | 
330 | set +e
331 | for i in {0..150}; do
332 | 	sleep 2
333 | 	# check contiv pods
334 | 	$kubectl get pods -n kube-system --request-timeout=1s | grep -v "Running" | grep -q ^contiv && continue
335 | 	# check netplugin status
336 | 	curl -s localhost:9090/inspect/driver | grep -wq FwdMode || continue
337 | 	break
338 | done
339 | 
340 | [[ $i -ge 150 ]] && error_ret "contiv pods are not ready !!"
341 | 
342 | set -e
343 | 
344 | echo "Installation is complete"
345 | echo "========================================================="
346 | echo " "
347 | echo "Contiv UI is available at https://$netmaster:10000"
348 | echo "Please use the first run wizard or configure the setup as follows:"
349 | echo " Configure forwarding mode (optional, default is routing)."
350 | echo " netctl global set --fwd-mode routing"
351 | echo " Configure ACI mode (optional)"
352 | echo " netctl global set --fabric-mode aci --vlan-range <start>-<end>"
353 | echo " Create a default network"
354 | echo " netctl net create -t default --subnet=<CIDR> default-net"
355 | echo " For example, netctl net create -t default --subnet=20.1.1.0/24 -g 20.1.1.1 default-net"
356 | echo " "
357 | echo "========================================================="
358 | 


--------------------------------------------------------------------------------
/install/k8s/uninstall.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | if [ $EUID -ne 0 ]; then
 4 | 	echo "Please run this script as root user"
 5 | 	exit 1
 6 | fi
 7 | 
 8 | kubectl="kubectl --kubeconfig /etc/kubernetes/admin.conf"
 9 | k8sversion=$($kubectl version --short | grep "Server Version")
10 | if [ "$#" -eq 1 ] && [ "$1" = "-h" ]; then
11 | 	echo "Usage: ./install/k8s/uninstall.sh to uninstall contiv"
12 | 	echo "       ./install/k8s/uninstall.sh etcd-cleanup to uninstall contiv and cleanup contiv data"
13 | 	exit 1
14 | fi
15 | 
16 | # Delete the ACI secret if it is available
17 | $kubectl delete secret aci.key -n kube-system
18 | 
19 | # Delete Contiv pods
20 | $kubectl delete -f .contiv.yaml
21 | 
22 | if [ "$#" -eq 1 ] && [ "$1" = "etcd-cleanup" ]; then
23 | 	rm -rf /var/etcd/contiv-data
24 | fi
25 | 
26 | $kubectl create -f install/k8s/configs/cleanup.yaml
27 | sleep 60
28 | $kubectl delete -f install/k8s/configs/cleanup.yaml
29 | 


--------------------------------------------------------------------------------
/installer.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/contiv/install/4b5be515558a492a07e9b835c28c8a5815db30f6/installer.png


--------------------------------------------------------------------------------
/scripts/build.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | # Required environment variables:
  4 | # * CONTIV_INSTALLER_VERSION - sets the tarball artifact filenames
  5 | # * CONTIV_NETPLUGIN_VERSION - updates config files to locate contiv tarball
  6 | # * CONTIV_V2PLUGIN_VERSION - which v2plugin version to download during install
  7 | # * CONTIV_ACI_GW_VERSION - which aci_gw version to download during install
  8 | 
  9 | set -xeuo pipefail
 10 | 
 11 | # ensure this script wasn't called from the directory where this script
 12 | # lives; it should be called from the repository's top level
 13 | script_dir="$(dirname -- "$0")"
 14 | if [ "$script_dir" == "." ]; then
 15 | 	echo "This script must be called from the top level of the repository"
 16 | 	exit 1
 17 | fi
 18 | 
 19 | pull_images=${CONTIV_CI_HOST:-"false"}
 20 | aci_gw_version=${CONTIV_ACI_GW_VERSION:-"latest"}
 21 | ansible_image_version=${CONTIV_ANSIBLE_IMAGE:-contiv/install:$DEFAULT_DOWNLOAD_CONTIV_VERSION}
 22 | auth_proxy_version=${CONTIV_API_PROXY_VERSION:-$DEFAULT_DOWNLOAD_CONTIV_VERSION}
 23 | docker_version=${CONTIV_DOCKER_VERSION:-1.12.6}
 24 | etcd_version=${CONTIV_ETCD_VERSION:-v3.2.4}
 25 | v2plugin_version=${CONTIV_V2PLUGIN_VERSION}
 26 | 
 27 | # where everything is assembled, always start with a clean dir and clean it up
 28 | output_tmp_dir="$(mktemp -d)"
 29 | output_dir="${output_tmp_dir}/contiv-${CONTIV_INSTALLER_VERSION}"
 30 | mkdir -p "${output_dir}"
 31 | trap 'rm -rf "${output_tmp_dir}"' EXIT
 32 | 
 33 | release_dir=release
 34 | mkdir -p $release_dir
 35 | output_file="${release_dir}/contiv-${CONTIV_INSTALLER_VERSION}.tgz"
 36 | full_output_file="$release_dir/contiv-full-${CONTIV_INSTALLER_VERSION}.tgz"
 37 | 
 38 | # Release files
 39 | # k8s - install.sh to take the args and construct contiv.yaml as required and to launch kubectl
 40 | # swarm - install.sh launches the container to do the actual installation
 41 | # Top level install.sh which will either take k8s/swarm install params and do the required.
 42 | cp -rf install README.md $output_dir
 43 | cp -rf scripts/generate-certificate.sh $output_dir/install
 44 | 
 45 | # Get the ansible support files
 46 | chmod +x $output_dir/install/genInventoryFile.py
 47 | chmod +x $output_dir/install/generate-certificate.sh
 48 | 
 49 | if [ -d ${CONTIV_ARTIFACT_STAGING}/ansible ]; then
 50 | 	cp -a "${CONTIV_ARTIFACT_STAGING}/ansible" ${output_dir}/
 51 | fi
 52 | 
 53 | # Replace versions
 54 | files=$(find $output_dir -type f -name "*.yaml" -or -name "*.sh" -or -name "*.json")
 55 | sed -i.bak 's/__ACI_GW_VERSION__/'"$aci_gw_version"'/g' $files
 56 | sed -i.bak 's/__API_PROXY_VERSION__/'"$auth_proxy_version"'/g' $files
 57 | sed -i.bak 's#__CONTIV_INSTALL_VERSION__#'"$ansible_image_version"'#g' $files
 58 | sed -i.bak 's/__CONTIV_VERSION__/'"$CONTIV_NETPLUGIN_VERSION"'/g' $files
 59 | sed -i.bak 's/__DOCKER_VERSION__/'"$docker_version"'/g' $files
 60 | sed -i.bak 's/__ETCD_VERSION__/'"$etcd_version"'/g' $files
 61 | sed -i.bak 's/__CONTIV_V2PLUGIN_VERSION__/'"$v2plugin_version"'/g' $files
 62 | 
 63 | # Make all shell script files executable
 64 | chmod +x $(find $output_dir -type f -name "*.sh")
 65 | 
 66 | # Clean up the Dockerfile, it is not part of the release bits.
 67 | rm -f $output_dir/install/ansible/Dockerfile
 68 | 
 69 | # Create the binary cache folder
 70 | binary_cache=$output_dir/contiv_cache
 71 | mkdir -p $binary_cache
 72 | 
 73 | # only build installer that pulls artifacts over internet if not building
 74 | # a specific commit of netplugin
 75 | if [ -z "${NETPLUGIN_BRANCH:-}" ]; then
 76 | 	# Create the minimal tar bundle
 77 | 	tar czf $output_file -C $output_tmp_dir contiv-${CONTIV_INSTALLER_VERSION}
 78 | 	echo -n "Contiv Installer version '$CONTIV_INSTALLER_VERSION' with "
 79 | 	echo "netplugin version '$CONTIV_NETPLUGIN_VERSION' is available "
 80 | 	echo "at '$output_file'"
 81 | fi
 82 | 
 83 | # Save the auth proxy & aci-gw images for packaging the full docker images with contiv install binaries
 84 | if [[ "$(docker images -q contiv/auth_proxy:$auth_proxy_version 2>/dev/null)" == "" || "$pull_images" == "true" ]]; then
 85 | 	docker pull contiv/auth_proxy:$auth_proxy_version
 86 | fi
 87 | docker save contiv/auth_proxy:$auth_proxy_version -o $binary_cache/auth-proxy-image.tar
 88 | 
 89 | if [[ "$(docker images -q contiv/aci-gw:$aci_gw_version 2>/dev/null)" == "" || "$pull_images" == "true" ]]; then
 90 | 	docker pull contiv/aci-gw:$aci_gw_version
 91 | fi
 92 | docker save contiv/aci-gw:$aci_gw_version -o $binary_cache/aci-gw-image.tar
 93 | 
 94 | if [ -f $CONTIV_ARTIFACT_STAGING/netplugin-image-${CONTIV_NETPLUGIN_VERSION}.tar ]; then
 95 | 	cp $CONTIV_ARTIFACT_STAGING/netplugin-image-${CONTIV_NETPLUGIN_VERSION}.tar $binary_cache/
 96 | fi
 97 | 
 98 | curl --fail -sL -o $binary_cache/openvswitch-2.5.0-2.el7.x86_64.rpm http://cbs.centos.org/kojifiles/packages/openvswitch/2.5.0/2.el7/x86_64/openvswitch-2.5.0-2.el7.x86_64.rpm
 99 | curl --fail -sL -o $binary_cache/ovs-common.deb http://mirrors.kernel.org/ubuntu/pool/main/o/openvswitch/openvswitch-common_2.5.2-0ubuntu0.16.04.3_amd64.deb
100 | curl --fail -sL -o $binary_cache/ovs-switch.deb http://mirrors.kernel.org/ubuntu/pool/main/o/openvswitch/openvswitch-switch_2.5.2-0ubuntu0.16.04.3_amd64.deb
101 | 
102 | # Copy the netplugin release into the binary cache for "full" installer
103 | # Netplugin releases built locally based on a branch are named by their SHA,
104 | # but there is a symlink to point to the SHA named tarball by it's branch name
105 | plugin_tball="${CONTIV_ARTIFACT_STAGING}/$CONTIV_NETPLUGIN_TARBALL_NAME"
106 | if [[ -L "${plugin_tball}" ]]; then
107 | 	# copy the link (so other processes can find the tarball) and the tarball
108 | 	target_plugin_tball="$(readlink "${plugin_tball}")"
109 | 	cp -a "${plugin_tball}" "${binary_cache}/"
110 | 	plugin_tball="${CONTIV_ARTIFACT_STAGING}/${target_plugin_tball}"
111 | fi
112 | if [ -f "${plugin_tball}" ]; then
113 | 	cp "${plugin_tball}" "${binary_cache}/"
114 | fi
115 | 
116 | # copy v2plugin assets if built locally on branch
117 | if [ -n "${NETPLUGIN_BRANCH:-}" ]; then
118 | 	if [ -L "${CONTIV_ARTIFACT_STAGING}/$CONTIV_V2PLUGIN_TARBALL_NAME" ]; then
119 | 		cp "${CONTIV_ARTIFACT_STAGING}/${CONTIV_V2PLUGIN_TARBALL_NAME}" "${binary_cache}/"
120 | 		v2plugin_tball="$(readlink ${CONTIV_ARTIFACT_STAGING}/${CONTIV_V2PLUGIN_TARBALL_NAME})"
121 | 		if [ -f "$v2plugin_tball" ]; then
122 | 			cp -a "$v2plugin_tball" "${binary_cache}/"
123 | 		fi
124 | 	fi
125 | 
126 | 	if [ -f "${CONTIV_ARTIFACT_STAGING}/config.json" ]; then
127 | 		cp "${CONTIV_ARTIFACT_STAGING}/config.json" "${binary_cache}/"
128 | 	fi
129 | 
130 | fi
131 | 
132 | env_file=$output_dir/install/ansible/env.json
133 | sed -i.bak 's#__AUTH_PROXY_LOCAL_INSTALL__#true#g' "$env_file"
134 | sed -i.bak 's#__CONTIV_NETWORK_LOCAL_INSTALL__#true#g' "$env_file"
135 | 
136 | echo "Ansible extra vars from env.json:"
137 | cat $env_file
138 | # Create the full tar bundle
139 | tar czf $full_output_file -C $output_tmp_dir contiv-${CONTIV_INSTALLER_VERSION}
140 | echo -n "Contiv Installer version '$CONTIV_INSTALLER_VERSION' with "
141 | echo "netplugin version '$CONTIV_NETPLUGIN_VERSION' is available "
142 | echo "at '$full_output_file', it includes all contiv assets "
143 | echo "required for installation"
144 | echo
145 | echo -e "\nSuccess"
146 | 


--------------------------------------------------------------------------------
/scripts/build_image.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | 
3 | set -euo pipefail
4 | VERSION=${BUILD_VERSION-"latest"}
5 | 
6 | # Build the docker container for ansible installation
7 | ansible_spec=./install/ansible/Dockerfile
8 | docker build -t contiv/install:$VERSION -f $ansible_spec .
9 | 


--------------------------------------------------------------------------------
/scripts/download_ansible_repo.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | ANSIBLE_REPO_DIR="${CONTIV_ARTIFACT_STAGING}/ansible"
 6 | 
 7 | rm -rf "$ANSIBLE_REPO_DIR"
 8 | 
 9 | mkdir -p "$ANSIBLE_REPO_DIR" "$CONTIV_ARTIFACT_STAGING"
10 | 
11 | echo downloading ${CONTIV_ANSIBLE_OWNER}/ansible commit: $CONTIV_ANSIBLE_COMMIT
12 | curl --fail -sL https://api.github.com/repos/${CONTIV_ANSIBLE_OWNER}/ansible/tarball/$CONTIV_ANSIBLE_COMMIT |
13 | 	tar --strip-components 1 -C "$ANSIBLE_REPO_DIR" -z -x
14 | 


--------------------------------------------------------------------------------
/scripts/generate-certificate.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | PREFIX="./local_certs"
 6 | KEY_PATH="$PREFIX/local.key"
 7 | CERT_PATH="$PREFIX/cert.pem"
 8 | 
 9 | # if both files exist, just exit
10 | if [[ -f $KEY_PATH && -f $CERT_PATH ]]; then
11 | 	exit 0
12 | fi
13 | 
14 | rm -f $KEY_PATH
15 | rm -f $CERT_PATH
16 | 
17 | openssl genrsa -out $KEY_PATH 2048 >/dev/null 2>&1
18 | openssl req -new -x509 -sha256 -days 3650 \
19 | 	-key $KEY_PATH \
20 | 	-out $CERT_PATH \
21 | 	-subj "/C=US/ST=CA/L=San Jose/O=CPSG/OU=IT Department/CN=auth-local.cisco.com"
22 | 
23 | echo "Created $KEY_PATH and $CERT_PATH"
24 | 


--------------------------------------------------------------------------------
/scripts/get_latest_release.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | 
 3 | import json
 4 | import requests
 5 | import sys
 6 | 
 7 | HTTP_OK = 200
 8 | 
 9 | # Try to get the latest release version
10 | r = requests.get("https://api.github.com/repos/contiv/install/releases/latest")
11 | if r.status_code != HTTP_OK:
12 |    print >> sys.stderr, "failed to get latest release, status code: %d" % r.status_code
13 |    sys.exit(1)
14 | else:
15 |    releases = json.loads(r.content)
16 |    print releases['name']
17 | 


--------------------------------------------------------------------------------
/scripts/get_latest_release.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | # Check if the user requested a specific build
 6 | if [[ ! -z "${BUILD_VERSION-}" ]]; then
 7 | 	echo $BUILD_VERSION
 8 | 	exit 0
 9 | fi
10 | 
11 | # Try to get the latest release
12 | releases=$(curl -s https://api.github.com/repos/contiv/install/releases/latest)
13 | if [[ "$releases" != *"browser_download_url"* ]]; then
14 | 	echo >&2 "failed to get latest release"
15 | 	exit 1
16 | fi
17 | 
18 | release=$(echo "$releases" | python -c 'import json, sys; print(json.load(sys.stdin)["name"])')
19 | echo $release
20 | 
21 | exit 0
22 | 


--------------------------------------------------------------------------------
/scripts/jenkins_cleanup.sh:
--------------------------------------------------------------------------------
 1 | #/!/bin/bash
 2 | 
 3 | # Script run on the Jenkins Node after the build(tests) are completed.
 4 | # Forcibly cleans up _ALL_ VirtualBox VMs, not just those created during
 5 | # the Jenkins run.
 6 | 
 7 | # Doing each command with "|| true" so that even if a command fails, it won't
 8 | # cause Jenkins to mark the build as failed.
 9 | 
10 | set -e
11 | 
12 | echo "Starting cleanup."
13 | echo "Existing VMs:"
14 | vboxmanage list vms
15 | echo "------------"
16 | 
17 | cd $WORKSPACE/src/github.com/contiv/netplugin
18 | vagrant destroy -f || true
19 | 
20 | rm -rf /home/admin/VirtualBox\ VMs/* || true
21 | rm -rf .vagrant/* || true
22 | rm -f *.vdi || true
23 | 
24 | for f in $(vboxmanage list vms | awk {'print $2'} | cut -d'{' -f2 | cut -d'}' -f1); do
25 | 	echo $f
26 | 	vboxmanage controlvm $f poweroff || true
27 | 	sleep 5
28 | 	vboxmanage unregistervm --delete $f || true
29 | done
30 | 
31 | echo "Cleanup finished."
32 | echo "any VMs still left?"
33 | vboxmanage list vms
34 | echo "------------"
35 | 


--------------------------------------------------------------------------------
/scripts/kube_legacy_test.sh:
--------------------------------------------------------------------------------
 1 | ssh_key=${CONTIV_SSH_KEY:-cluster/insecure_private_key}
 2 | user=${CONTIV_SSH_USER:-vagrant}
 3 | install_bundle=${CONTIV_RELEASE:-release/contiv-devbuild.tgz}
 4 | contiv_os=${CONTIV_NODE_OS:-centos7}
 5 | 
 6 | # Copy the installation folder
 7 | scp -i $ssh_key $install_bundle $user@contiv-master:/tmp/
 8 | 
 9 | # Copy the configuration file
10 | scp -i $ssh_key $config_file $user@contiv-master:/tmp/
11 | 
12 | # Extract and launch the installer
13 | ssh -i $ssh_key $user@contiv-master "cd /tmp && tar -xvzf $install_bundle && chmod +x contiv/ansible/install_k8s.sh"
14 | ssh -i $ssh_key $user@contiv-master "CONTIV_KUBEADM=1 CONTIV_NODE_OS=$contiv_os contiv/ansible/install_k8s.sh"
15 | 


--------------------------------------------------------------------------------
/scripts/kubeadm_test.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | set -exuo pipefail
  4 | 
  5 | # Get the master node IP from the yml file generated by vagrant
  6 | contiv_master=$(grep -B 3 master cluster/.cfg_kubeadm.yaml | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}" | xargs)
  7 | node_os=${CONTIV_NODE_OS:-"centos"}
  8 | # Default user is vagrant for non-ubuntu and ubuntu for ubuntu boxes.
  9 | if [ "$node_os" == "ubuntu" ]; then
 10 | 	def_user="ubuntu"
 11 | 	def_key="$HOME/.ssh/id_rsa"
 12 | else
 13 | 	def_user="vagrant"
 14 | 	def_key=""
 15 | fi
 16 | user=${CONTIV_SSH_USER:-"$def_user"}
 17 | 
 18 | # If BUILD_VERSION is not defined, we use a local dev build, that must have been created with make release
 19 | install_version="contiv-${BUILD_VERSION:-devbuild}"
 20 | default_net_cidr="${DEFAULT_NET:-20.1.1.0/24}"
 21 | default_net_gw="${DEFAULT_NET:-20.1.1.1}"
 22 | release_local_tarball="contiv-full-${BUILD_VERSION}.tgz"
 23 | 
 24 | if [ -f "release/${release_local_tarball}" ]; then
 25 | 	# extract docker images under shared mount direcotry
 26 | 	tar -xzf release/$release_local_tarball ${install_version}/contiv_cache/*.tar
 27 | 	pushd cluster
 28 | 	for vm in $(vagrant status | awk '/kubeadm/{print $1}'); do
 29 | 		keyfile=$(mktemp)
 30 | 		vagrant ssh-config $vm >$keyfile
 31 | 		for img in $(ls -1 ../${install_version}/contiv_cache/*.tar); do
 32 | 			scp -F $keyfile $img $vm:/tmp/
 33 | 			ssh -F $keyfile $vm -- sudo docker load -i /tmp/$(basename $img)
 34 | 		done
 35 | 		rm -f $keyfile
 36 | 	done
 37 | 	popd
 38 | 
 39 | 	pushd cluster
 40 | 	ssh_key=${CONTIV_SSH_KEY:-"$def_key"}
 41 | 	if [ "$ssh_key" == "" ]; then
 42 | 		ssh_key=$(vagrant ssh-config kubeadm-master | grep IdentityFile | awk '{print $2}' | xargs)
 43 | 	fi
 44 | 	popd
 45 | 	dest_path=${CONTIV_TARGET:-"/home/$user"}
 46 | 	ssh_opts="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
 47 | 
 48 | 	# Copy the installation folder
 49 | 	scp $ssh_opts -i $ssh_key release/${release_local_tarball} $user@$contiv_master:$dest_path/${install_version}.tgz
 50 | 	curl_cmd="echo 'Devbuild'"
 51 | else
 52 | 	# github redirects you to a signed AWS URL, so we need to follow redirects with -L
 53 | 	curl_cmd="curl -L -O https://github.com/contiv/install/releases/download/${BUILD_VERSION}/${install_version}.tgz"
 54 | fi
 55 | # Extract the install bundle and launch the installer
 56 | set +e # read returns 1 when it succeeds
 57 | read -r -d '' COMMANDS <<-EOF
 58 |     sudo rm -rf ${install_version} && \\
 59 |     ${curl_cmd} && tar oxf ${install_version}.tgz && \\
 60 |     cd ${install_version} && \\
 61 |     sudo ./install/k8s/install.sh -n ${contiv_master}
 62 | EOF
 63 | set -e
 64 | 
 65 | cd cluster
 66 | vagrant ssh kubeadm-master -- "$COMMANDS"
 67 | 
 68 | set +e
 69 | read -r -d '' SETUP_DEFAULT_NET <<-EOF
 70 |     cd ${install_version} && \\
 71 |     netctl net create -s ${default_net_cidr} -g ${default_net_gw} default-net
 72 | EOF
 73 | set -e
 74 | 
 75 | echo "*****************"
 76 | # Wait for CONTIV to start for up to 10 minutes
 77 | sleep 10
 78 | for i in {0..20}; do
 79 | 	response=$(curl -k -s -H "Content-Type: application/json" -X POST -d '{"username": "admin", "password": "admin"}' https://$contiv_master:10000/api/v1/auth_proxy/login/ || true)
 80 | 	if [[ $response == *"token"* ]]; then
 81 | 		echo "Install SUCCESS"
 82 | 		echo ""
 83 | 		cat <<EOF
 84 |   NOTE: Because the Contiv Admin Console is using a self-signed certificate for this demo,
 85 |   you will see a security warning when the page loads.  You can safely dismiss it.
 86 | 
 87 |   You can access the Contiv master node with:
 88 |     cd cluster && vagrant ssh kubeadm-master
 89 | 
 90 | EOF
 91 | 		if [ "$install_version" != "contiv-devbuild" ]; then
 92 | 			vagrant ssh kubeadm-master -- "${SETUP_DEFAULT_NET}"
 93 | 		fi
 94 | 		exit 0
 95 | 	else
 96 | 		echo "$i. Retry login to Contiv"
 97 | 		sleep 30
 98 | 	fi
 99 | done
100 | echo "Install FAILED"
101 | exit 1
102 | 


--------------------------------------------------------------------------------
/scripts/legacy_swarm_test.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | # Get the master node IP from the yml file generated by vagrant
 6 | contiv_master=$(grep -B 3 master cluster/.cfg_legacy-swarm.yaml | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}" | xargs)
 7 | 
 8 | node_os=${CONTIV_NODE_OS:-"centos"}
 9 | # Default user is vagrant for non-ubuntu and ubuntu for ubuntu boxes.
10 | if [ "$node_os" == "ubuntu" ]; then
11 | 	def_user="ubuntu"
12 | 	def_key="$HOME/.ssh/id_rsa"
13 | else
14 | 	def_user="vagrant"
15 | 	def_key=""
16 | fi
17 | user=${CONTIV_SSH_USER:-"$def_user"}
18 | 
19 | # If BUILD_VERSION is not defined, we use a local dev build, that must have been created with make release
20 | install_version="contiv-${BUILD_VERSION:-devbuild}"
21 | pushd cluster
22 | ssh_key=${CONTIV_SSH_KEY:-"$def_key"}
23 | if [ "$ssh_key" == "" ]; then
24 | 	ssh_key=$(vagrant ssh-config legacy-swarm-master | grep IdentityFile | awk '{print $2}' | xargs)
25 | fi
26 | popd
27 | 
28 | ./scripts/unpack-installer.sh
29 | 
30 | # Extract and launch the installer
31 | 
32 | cd release/$install_version
33 | ./install/ansible/install_swarm.sh -f ../../cluster/.cfg_legacy-swarm.yaml -e $ssh_key -u $user -i
34 | 
35 | # Wait for CONTIV to start for up to 10 minutes
36 | sleep 10
37 | for i in {0..20}; do
38 | 	response=$(curl -k -s -H "Content-Type: application/json" -X POST -d '{"username": "admin", "password": "admin"}' https://$contiv_master:10000/api/v1/auth_proxy/login/ || true)
39 | 	if [[ $response == *"token"* ]]; then
40 | 		echo "Install SUCCESS"
41 | 		echo ""
42 | 		cat <<EOF
43 |   NOTE: Because the Contiv Admin Console is using a self-signed certificate for this demo,
44 |   you will see a security warning when the page loads.  You can safely dismiss it.
45 | 
46 |   You can access the Contiv master node with:
47 |     cd cluster && vagrant ssh legacy-swarm-master
48 | EOF
49 | 		exit 0
50 | 	else
51 | 		echo "$i. Retry login to Contiv"
52 | 		sleep 30
53 | 	fi
54 | done
55 | echo "Install FAILED"
56 | exit 1
57 | 


--------------------------------------------------------------------------------
/scripts/prepare_netplugin_artifacts.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | # Produces a tarball of netplugin binaries at $CONTIV_ARTIFACT_STAGING
 4 | # It either:
 5 | # * retrieves netplugin-$CONTIV_NETPLUGIN_VERSION.tar.bz2 from github
 6 | #   releases
 7 | # or if $NETPLUGIN_BRANCH is set to an upstream branch name:
 8 | # * downloads the branch from fork owner $NETPLUGIN_OWNER and compiles
 9 | #   it, naming it netplugin-<COMMIT_SHA>.tar.bz2
10 | 
11 | set -euxo pipefail
12 | 
13 | : ${CONTIV_NETPLUGIN_TARBALL_NAME} # check if defined
14 | 
15 | mkdir -p "$CONTIV_ARTIFACT_STAGING"
16 | 
17 | # check if installer is for a release version of netplugin
18 | if [ -z "${NETPLUGIN_BRANCH:-}" ]; then
19 | 	echo Downloading netplugin-${CONTIV_NETPLUGIN_VERSION}
20 | 	# retrieve release vesion of netplugin
21 | 	base_url=https://github.com/contiv/netplugin/releases/download
22 | 	netplugin_bundle_name=netplugin-$CONTIV_NETPLUGIN_VERSION.tar.bz2
23 | 	curl -sL ${base_url}/$CONTIV_NETPLUGIN_VERSION/$netplugin_bundle_name \
24 | 		-o "${CONTIV_ARTIFACT_STAGING}/$netplugin_bundle_name"
25 | 	exit
26 | fi
27 | 
28 | # build netplugin based on SHA
29 | 
30 | # tempdir for building and cleanup on exit
31 | netplugin_tmp_dir="$(mktemp -d)"
32 | trap 'rm -rf ${netplugin_tmp_dir}' EXIT
33 | 
34 | echo Cloning ${NETPLUGIN_OWNER}/netplugin branch ${NETPLUGIN_BRANCH}
35 | # about 3x faster to pull the HEAD of a branch with no history
36 | git clone --branch ${NETPLUGIN_BRANCH} --depth 1 \
37 | 	https://github.com/${NETPLUGIN_OWNER}/netplugin.git \
38 | 	${netplugin_tmp_dir}/netplugin
39 | 
40 | # run the build and extract the binaries
41 | cd $netplugin_tmp_dir/netplugin
42 | # BUILD_VERSION (currently == devbuild) is in env, so clear it
43 | declare +x BUILD_VERSION
44 | # this is most likely to be just SHA because we pulled only single commit
45 | NETPLUGIN_VERSION=$(./scripts/getGitVersion.sh)
46 | BUILD_VERSION=${NETPLUGIN_VERSION} make tar host-pluginfs-create
47 | 
48 | # move the netplugin tarball to the staging directory for the installer
49 | mv netplugin-${NETPLUGIN_VERSION}.tar.bz2 "${CONTIV_ARTIFACT_STAGING}/"
50 | # move the v2plugin tarball to the staging directory for the installer
51 | mv install/v2plugin/v2plugin-${NETPLUGIN_VERSION}.tar.gz "${CONTIV_ARTIFACT_STAGING}/"
52 | # copy the container's config.json needed to create the v2plugin
53 | cp install/v2plugin/config.json "${CONTIV_ARTIFACT_STAGING}/"
54 | 
55 | # create links so other scripts can find the archives without knowing the SHA
56 | cd "${CONTIV_ARTIFACT_STAGING}"
57 | ln -sf netplugin-${NETPLUGIN_VERSION}.tar.bz2 $CONTIV_NETPLUGIN_TARBALL_NAME
58 | ln -sf v2plugin-${NETPLUGIN_VERSION}.tar.gz $CONTIV_V2PLUGIN_TARBALL_NAME
59 | 


--------------------------------------------------------------------------------
/scripts/prepare_netplugin_images.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | # Prepare k8s netplugin image
 4 | # * retrieves contiv/netplugin:$CONTIV_NETPLUGIN_VERSION from dockerhub
 5 | #
 6 | # or if $NETPLUGIN_BRANCH is set to an upstream branch name:
 7 | # * downloads the branch from fork owner $NETPLUGIN_OWNER and build k8s netplugin
 8 | #   image, export it as tarball
 9 | 
10 | set -euxo pipefail
11 | 
12 | mkdir -p "$CONTIV_ARTIFACT_STAGING"
13 | 
14 | #### ENSURE contiv/netplugin:<tag> exists #####
15 | 
16 | if [ -z "${NETPLUGIN_BRANCH:-}" ]; then
17 | 	echo "Trying to use dockerhub contiv/netplugin:${CONTIV_NETPLUGIN_VERSION}"
18 | 	# ensure the image exists
19 | 	http_rc=$(curl -L -s -w "%{http_code}" -o /dev/null https://hub.docker.com/v2/repositories/contiv/netplugin/tags/${CONTIV_NETPLUGIN_VERSION}/)
20 | 	if [ "$http_rc" = 200 ]; then
21 | 		echo "Found contiv/netplugin:${CONTIV_NETPLUGIN_VERSION} on dockerhub, exit 0"
22 | 	else
23 | 		echo "Failed to find contiv/netplugin:${CONTIV_NETPLUGIN_VERSION} on dockerhub, return code $http_rc, exit 1"
24 | 		exit 1
25 | 	fi
26 | else
27 | 	# tempdir for building and cleanup on exit
28 | 	netplugin_tmp_dir="$(mktemp -d)"
29 | 	trap 'rm -rf ${netplugin_tmp_dir}' EXIT
30 | 
31 | 	echo Cloning ${NETPLUGIN_OWNER}/netplugin branch ${NETPLUGIN_BRANCH}
32 | 	# about 3x faster to pull the HEAD of a branch with no history
33 | 	git clone --branch ${NETPLUGIN_BRANCH} --depth 1 \
34 | 		https://github.com/${NETPLUGIN_OWNER}/netplugin.git \
35 | 		${netplugin_tmp_dir}/netplugin
36 | 
37 | 	# Try to build docker image locally
38 | 	cd $netplugin_tmp_dir/netplugin
39 | 	make host-build-docker-image
40 | 
41 | 	# the new built image tagged contivbase:latest
42 | 	# below codes probably should goto netplugin, here just a hacking way
43 | 	docker tag contivbase:latest contiv/netplugin:${CONTIV_NETPLUGIN_VERSION}
44 | 	docker save contiv/netplugin:${CONTIV_NETPLUGIN_VERSION} -o $CONTIV_ARTIFACT_STAGING/netplugin-image-${CONTIV_NETPLUGIN_VERSION}.tar
45 | fi
46 | #### ENSURE contiv/auth_proxy:<tag> exists #####
47 | 
48 | auth_proxy_version=${CONTIV_API_PROXY_VERSION:-$DEFAULT_DOWNLOAD_CONTIV_VERSION}
49 | 
50 | if [ -z "${NETPLUGIN_AUTH_PROXY_BRANCH:-}" ]; then
51 | 	echo "Trying to use dockerhub contiv/auth_proxy:${auth_proxy_version}"
52 | 	# ensure the image exists
53 | 	http_rc=$(curl -L -s -w "%{http_code}" -o /dev/null https://hub.docker.com/v2/repositories/contiv/auth_proxy/tags/${auth_proxy_version}/)
54 | 	if [ "$http_rc" = 200 ]; then
55 | 		echo "Found contiv/auth_proxy:${auth_proxy_version} on dockerhub, exit 0"
56 | 	else
57 | 		echo "Failed to find contiv/auth_proxy:${auth_proxy_version} on dockerhub, return code $http_rc, exit 1"
58 | 		exit 1
59 | 	fi
60 | else
61 | 	# tempdir for building and cleanup on exit
62 | 	auth_proxy_tmp_dir="$(mktemp -d)"
63 | 	trap 'rm -rf ${auth_proxy_tmp_dir}' EXIT
64 | 
65 | 	echo Cloning ${NETPLUGIN_AUTH_PROXY_OWNER}/auth_proxy branch ${NETPLUGIN_AUTH_PROXY_BRANCH}
66 | 	# about 3x faster to pull the HEAD of a branch with no history
67 | 	git clone --branch ${NETPLUGIN_AUTH_PROXY_BRANCH} --depth 1 \
68 | 		https://github.com/${NETPLUGIN_AUTH_PROXY_OWNER}/auth_proxy.git \
69 | 		${auth_proxy_tmp_dir}/auth_proxy
70 | 
71 | 	# Try to build docker image locally
72 | 	cd $auth_proxy_tmp_dir/auth_proxy
73 | 	# this also checkouts contiv-ui master branch
74 | 	BUILD_VERSION=master make build
75 | 	# tag the same version with netplugin
76 | 	docker tag contiv/auth_proxy:master contiv/auth_proxy:${auth_proxy_version}
77 | fi
78 | 


--------------------------------------------------------------------------------
/scripts/release.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | # Assumes following variables to be defined:
 3 | #  OLD_VERSION - previous version against which to create changelog
 4 | #  BUILD_VERSION - new version being released
 5 | #  GITHUB_USER - contiv
 6 | #  GITHUB_TOKEN - your github token
 7 | #  USE_RELEASE - if 0 or not set, will make a pre-release
 8 | 
 9 | cd -P -- "$(dirname -- "$0")"
10 | 
11 | # Install github-release binary if not present
12 | if [ -z "$(which github-release)" ]; then
13 | 	go get -u github.com/aktau/github-release || exit 1
14 | fi
15 | 
16 | if [ -z "$BUILD_VERSION" ]; then
17 | 	echo "A release requires BUILD_VERSION to be defined"
18 | 	exit 1
19 | fi
20 | 
21 | if [ -z "$OLD_VERSION" ]; then
22 | 	echo "A release requires OLD_VERSION to be defined"
23 | 	exit 1
24 | fi
25 | 
26 | if [ "$OLD_VERSION" != "none" ]; then
27 | 	comparison="$OLD_VERSION..HEAD"
28 | fi
29 | 
30 | if [ "$USE_RELEASE" != "1" ]; then
31 | 	echo "Making a pre-release..."
32 | 	pre_release="-p"
33 | fi
34 | 
35 | if [ "$OLD_VERSION" != "none" ]; then
36 | 	changelog=$(git log $comparison --oneline --no-merges --reverse)
37 | 
38 | 	if [ -z "$changelog" ]; then
39 | 		echo "No new changes to release!"
40 | 		exit 0
41 | 	fi
42 | else
43 | 	changelog="don't forget to update the changelog"
44 | fi
45 | 
46 | TAR_FILENAME="contiv-"${BUILD_VERSION}".tgz"
47 | TAR_FILENAME2="contiv-full-"${BUILD_VERSION}".tgz"
48 | TAR_FILE="../release/contiv-"${BUILD_VERSION}".tgz"
49 | TAR_FILE2="../release/contiv-full-"${BUILD_VERSION}".tgz"
50 | if [ ! -f ${TAR_FILE} ] || [ ! -f ${TAR_FILE2} ]; then
51 | 	echo "release file(s) does not exist"
52 | 	exit 1
53 | fi
54 | 
55 | set -x
56 | ( (github-release -v release $pre_release -r install -t $BUILD_VERSION -d "**Changelog**<br/>$changelog") &&
57 | 	( (github-release -v upload -r install -t $BUILD_VERSION -n $TAR_FILENAME -f $TAR_FILE &&
58 | 		github-release -v upload -r install -t $BUILD_VERSION -n $TAR_FILENAME2 -f $TAR_FILE2) ||
59 | 		github-release -v delete -r install -t $BUILD_VERSION)) || exit 1
60 | 


--------------------------------------------------------------------------------
/scripts/swarm_mode_test.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | # Get the master node IP from the yml file generated by vagrant
 6 | contiv_master=$(grep -B 3 master cluster/.cfg_swarm-mode.yaml | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}" | head -n 1 | xargs)
 7 | 
 8 | node_os=${CONTIV_NODE_OS:-"centos"}
 9 | # Default user is vagrant for non-ubuntu and ubuntu for ubuntu boxes.
10 | if [ "$node_os" == "ubuntu" ]; then
11 | 	def_user="ubuntu"
12 | 	def_key="$HOME/.ssh/id_rsa"
13 | else
14 | 	def_user="vagrant"
15 | 	def_key=""
16 | fi
17 | user=${CONTIV_SSH_USER:-"$def_user"}
18 | 
19 | pushd cluster
20 | ssh_key=${CONTIV_SSH_KEY:-"$def_key"}
21 | if [ "$ssh_key" == "" ]; then
22 | 	ssh_key=$(vagrant ssh-config swarm-mode-master | grep IdentityFile | awk '{print $2}' | xargs)
23 | fi
24 | popd
25 | 
26 | # Extract and launch the installer
27 | mkdir -p release
28 | cd release
29 | # If BUILD_VERSION is not defined, we use a local dev build, that must have been created with make release
30 | release_name="contiv-${BUILD_VERSION:-devbuild}"
31 | release_tarball="${release_name}.tgz"
32 | release_local_tarball="contiv-full-${BUILD_VERSION}.tgz"
33 | if [ -f "${release_local_tarball}" ]; then
34 | 	tar oxf "${release_local_tarball}"
35 | else
36 | 	if [ ! -f "${release_tarball}" ]; then
37 | 		# For release builds, get the build from github releases
38 | 		curl -L -O https://github.com/contiv/install/releases/download/${BUILD_VERSION}/${release_name}.tgz
39 | 	fi
40 | 	tar oxf "${release_name}.tgz"
41 | fi
42 | 
43 | cd $release_name
44 | ./install/ansible/install_swarm.sh -f ../../cluster/.cfg_swarm-mode.yaml -e $ssh_key -u $user -p
45 | 
46 | # Wait for CONTIV to start for up to 10 minutes
47 | sleep 10
48 | for i in {0..20}; do
49 | 	response=$(curl -k -s -H "Content-Type: application/json" -X POST -d '{"username": "admin", "password": "admin"}' https://$contiv_master:10000/api/v1/auth_proxy/login/ || true)
50 | 	if [[ $response == *"token"* ]]; then
51 | 		echo "Install SUCCESS"
52 | 		echo ""
53 | 		cat <<EOF
54 |   NOTE: Because the Contiv Admin Console is using a self-signed certificate for this demo,
55 |   you will see a security warning when the page loads.  You can safely dismiss it.
56 |   
57 |   You can access the Contiv master node with:
58 |     cd cluster && vagrant ssh swarm-mode-master
59 | EOF
60 | 		exit 0
61 | 	else
62 | 		echo "$i. Retry login to Contiv"
63 | 		sleep 30
64 | 	fi
65 | done
66 | echo "Install FAILED"
67 | exit 1
68 | 


--------------------------------------------------------------------------------
/scripts/unpack-installer.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | # Will look for full installer, else the smaller installer, else download
 4 | # the installer and unpack it.  Assumes "devbuild" unless BUILD_VERSION
 5 | # is set
 6 | # 'BUILD_VERSION=1.2.3 unpack-installer.sh' looks for:
 7 | #  - contiv-full-1.2.3.tgz
 8 | #  - contiv-1.2.3.tgz
 9 | #  - https://github.com/contiv/install/releases/download/1.2.3/contiv-1.2.3.tgz
10 | 
11 | set -euo pipefail
12 | 
13 | cd "$(git rev-parse --show-toplevel)"
14 | mkdir -p release
15 | cd release
16 | 
17 | #################################
18 | # Extract the installer
19 | #################################
20 | 
21 | # If BUILD_VERSION is not defined, assume "devbuild" which presumably was
22 | # created with make BUILD_VERSION=devbuild
23 | BUILD_VERSION="${BUILD_VERSION:-devbuild}"
24 | release_name="contiv-${BUILD_VERSION}"
25 | 
26 | rm -rf ${release_name}
27 | 
28 | # this tarball has a cache of binary assets
29 | release_tarball="contiv-full-${BUILD_VERSION}.tgz"
30 | if [ ! -f "${release_tarball}" ]; then
31 | 	release_tarball="${release_name}.tgz"
32 | fi
33 | if [ ! -f "${release_tarball}" ]; then
34 | 	# For release builds, get the build from github releases
35 | 	echo Downloading ${release_tarball} from GitHub releases
36 | 	curl --fail -L -O https://github.com/contiv/install/releases/download/${BUILD_VERSION}/${release_tarball}
37 | fi
38 | 
39 | echo Unpacking ${release_tarball}
40 | tar -zoxf "${release_tarball}"
41 | 


--------------------------------------------------------------------------------
/scripts/vagrantup.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -euo pipefail
 4 | 
 5 | num_nodes=${CONTIV_NODES:-2}
 6 | num_masters=${CONTIV_MASTERS:-1}
 7 | ((num_workers = $num_nodes - $num_masters))
 8 | 
 9 | orc=$1
10 | cd cluster
11 | vagrant up $orc-master
12 | for ((n = 1; n < $num_masters; n++)); do
13 | 	vagrant up $orc-master$n
14 | done
15 | 
16 | for ((n = 0; n < $num_workers; n++)); do
17 | 	vagrant up $orc-worker$n
18 | done
19 | 


--------------------------------------------------------------------------------
/scripts/vbcleanup.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | 
3 | set -uo pipefail
4 | 
5 | vboxmanage list vms | grep -Ff <(cd cluster && vagrant status | grep "running" | awk '{print $1}') | awk -F '"' '{print $2}' | xargs -I {} vboxmanage controlvm {} poweroff
6 | vboxmanage list vms | grep -Ff <(cd cluster && vagrant status | grep "poweroff" | awk '{print $1}') | awk -F '"' '{print $2}' | xargs -I {} vboxmanage unregistervm --delete {}
7 | cd cluster && vagrant destroy -f
8 | exit 0
9 | 


--------------------------------------------------------------------------------